QISKIT · CVE-2026-116499 · Package
FIX → 2.6.2 ✓ verified
A crafted QPY file in an older format (version < 13) can carry Python code that runs when a process loads it with qiskit.qpy.load(). IBM and the Qiskit maintainers fixed it in Qiskit 2.6.2 by no longer using SymPy internally when deserializing those payloads. Local attack vector, no privileges or user interaction required per the CVSS vector.
first public Nov 8, 2026 · 2 sources
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Teams running Qiskit SDK >= 1.4.2 and < 2.6.2 whose Python code calls qiskit.qpy.load() on QPY files they did not produce, such as shared circuits, downloaded files, or files from other users on the same machine. Code that never loads QPY files, or only loads your own, is not exposed. Upgrade to 2.6.2.
Not affected if no-qpy-load, no-untrusted-input, outside-version-range
Who cares deserialization, python, qiskit, qpy, quantum
pip show qiskit; versions >= 1.4.2 and < 2.6.2 are affected (IBM's bulletin lists v1.4.2-v2.6.2 but names 2.6.2 as the patched release; GitHub advisory says <= 2.6.1).qiskit.qpy.load( / qpy.load and check whether the QPY files come from outside your control (downloads, shared storage, other users). Only QPY format versions < 13 are the exploitable path.IBM Qiskit SDK 1.4.2 through 2.6.2 could allow a local attacker to execute arbitrary code due to deserialization of untrusted data.
This page as .md · .json · CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
Upgrade to 2.6.2
Upgrade qiskit to 2.6.2 or later (pip install -U qiskit>=2.6.2).