Description
IBM Qiskit SDK 1.4.2 through 2.6.2 could allow a local attacker to execute arbitrary code due to deserialization of untrusted data.
Published: 2026-11-08
Score: 8.4 High
EPSS: n/a
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Analysis and contextual insights are available on OpenCVE Cloud.

Remediation

Vendor Solution

Remediation/Fixes guidance: The issue is addressed in Qiskit versions v2.6.2. This version is patched to no longer use SymPy internally during deserialization of payloads using QPY format versions < 13. Product(s)Version(s) number and/or range Remediation/Fix/Instructions< Qiskit SDK https://github.com/qiskit/qiskit - qiskit.qpy.load() function>v2.6.2 Upgrade to the patched versions: qiskit v2.6.2.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Sun, 08 Nov 2026 17:15:00 +0000

Type Values Removed Values Added
Description IBM Qiskit SDK 1.4.2 through 2.6.2 could allow a local attacker to execute arbitrary code due to deserialization of untrusted data.
Title Arbitrary Code Execution in Qiskit SDK QPY Deserialization
First Time appeared Ibm
Ibm qiskit Sdk
Weaknesses CWE-502
CPEs cpe:2.3:a:ibm:qiskit_sdk:1.4.2:*:*:*:*:*:*:*
cpe:2.3:a:ibm:qiskit_sdk:2.6.2:*:*:*:*:*:*:*
Vendors & Products Ibm
Ibm qiskit Sdk
References
Metrics cvssV3_1

{'score': 8.4, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'}

Subscriptions

Ibm Qiskit Sdk
cve-icon MITRE

Status: PUBLISHED

Assigner: ibm

Published:

Updated: 2026-11-08T17:04:13.456Z

Reserved: 2026-10-26T12:58:16.604Z

Link: CVE-2026-116499

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-11-08T17:16:36.870

Modified: 2026-11-08T17:16:36.977

Link: CVE-2026-116499

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

No data.

Weaknesses
  • CWE-502

    Deserialization of Untrusted Data