The serialization framework in LabOne Q performs dynamic class import by calling a function that accepts fully-qualified class names from a serialized file and then creates an instance of that class with arguments supplied by the file. The vulnerability allows an attacker to provide a crafted experiment file containing arbitrary class names and constructor parameters, resulting in the deserialization engine importing and executing the attacker‑controlled code. This can lead to arbitrary code execution within the context of the user running LabOne Q, potentially exposing the system to secrets, tampering, or further payloads.

All users of Zurich Instruments LabOne Q that have not upgraded to the security‑backported version 26.1.2 or to 26.4.0 or newer are affected. Version information for earlier releases is not listed explicitly, so any LabOne Q build prior to those releases is presumed vulnerable.

The CVSS score of 8.4 classifies this flaw as high severity, and the vulnerability is explicitly listed outside the CISA KEV catalog. Exploitation requires a victim to load a malicious experiment file, which can be obtained through collaboration or support channels. The attack vector is therefore file‑based deserialization, with the attacker supplying an untrusted file that is opened by a user of LabOne Q. Because the flaw permits arbitrary code execution in the user's context, the risk is significant, but exploitation probability depends on exposure to such files, which is not quantified by an EPSS score.