{"id":"CVE-2026-116499","kind":"vulnerability","aliases":["CVE-2026-116499"],"related":[],"title":"Qiskit SDK: loading a crafted QPY file (format < 13) with qiskit.qpy.load() runs attacker code","description":"IBM Qiskit SDK 1.4.2 through 2.6.2 could allow a local attacker to execute arbitrary code due to deserialization of untrusted data.","summary":"A crafted QPY file in an older format (version < 13) can carry Python code that runs when a process loads it with qiskit.qpy.load(). IBM and the Qiskit maintainers fixed it in Qiskit 2.6.2 by no longer using SymPy internally when deserializing those payloads. Local attack vector, no privileges or user interaction required per the CVSS vector.","severity":"high","cvss":8.4,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"qiskit","fixed":["2.6.2"],"affected":">= 1.4.2, < 2.6.2","ecosystem":"pypi"}],"ecosystems":[],"tags":["deserialization","package","python","qiskit","qpy","quantum"],"not_affected_if":["no-qpy-load","no-untrusted-input","outside-version-range"],"how_to_check":"- Run `pip show qiskit`; versions >= 1.4.2 and < 2.6.2 are affected (IBM's bulletin lists v1.4.2-v2.6.2 but names 2.6.2 as the patched release; GitHub advisory says <= 2.6.1).\n- Search your code for `qiskit.qpy.load(` / `qpy.load` and check whether the QPY files come from outside your control (downloads, shared storage, other users). Only QPY format versions < 13 are the exploitable path.\n- No workaround is listed by IBM; do not load QPY files from untrusted sources until upgraded.","fix":"Upgrade qiskit to 2.6.2 or later (pip install -U 'qiskit>=2.6.2').","status":"open","published_at":"2026-11-08T17:16:36+00:00","first_seen_at":"2026-11-08T17:22:01+00:00","triaged_at":"2026-11-08T17:24:13+00:00","updated_at":"2026-11-08T17:25:42+00:00","category":"package","confidence":0.85,"triage":{"at":"2026-11-08T17:24:13Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"Qiskit SDK: untrusted data deserialization lets a local user run code","impact":"high","summary":"IBM Qiskit SDK versions 1.4.2 through 2.6.2 deserialize untrusted data unsafely. A local attacker who can supply crafted input can execute arbitrary code on the machine running Qiskit.","audience":"developers","category":"package","nicknames":[],"who_cares":["qiskit","python","quantum"],"confidence":0.6,"fix_status":"unknown","needs_auth":"unknown","worst_case":"code runs as the local user running Qiskit","analyst_note":"Find the IBM security bulletin for Qiskit and confirm the fixed version and the affected deserialization path.","how_to_check":"- Check the installed Qiskit version with `pip show qiskit` and see whether it falls in 1.4.2 through 2.6.2.\n- Find where the code loads serialized or pickled data from files or other users and review those inputs.","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["outside-version-range","no-untrusted-input"],"who_is_affected":"Teams that run Qiskit SDK 1.4.2 through 2.6.2 on machines where untrusted or third-party data is loaded. The sources do not say which Qiskit features perform the deserialization, so the exposed code path is unknown.","user_interaction":"unknown","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.00071,"input_tokens":4522,"output_tokens":516,"severity_before":"high"},"analyst_status":"done","analyst_note":"Find the IBM security bulletin for Qiskit and confirm the fixed version and the affected deserialization path.","search":"'-116499':17A,20A '-2026':16A,19A '1.4.2':87C '13':9A,37B '2.6.2':60B,89C 'allow':91C 'arbitrari':97C 'attack':13A,72B,94C 'carri':39B 'code':14A,41B,98C 'could':90C 'craft':5A,29B 'cve':15A,18A 'cvss':82B 'data':104C 'deseri':22B,68B,101C 'due':99C 'execut':96C 'file':7A,31B 'fix':56B 'format':8A,35B 'ibm':51B,84C 'interact':78B 'intern':66B 'load':3A,47B 'local':71B,93C 'longer':63B 'maintain':55B 'older':34B 'packag':23B 'payload':70B 'per':80B 'privileg':75B 'process':46B 'python':24B,40B 'qiskit':1A,21A,25B,54B,59B,85C 'qiskit.qpy.load':11A,50B 'qpi':6A,26B,30B 'quantum':27B 'requir':79B 'run':12A,43B 'sdk':2A,86C 'sympi':65B 'untrust':103C 'use':64B 'user':77B 'vector':73B,83B 'version':36B","nicknames":[],"mitigations":[],"who_affected":"Teams running Qiskit SDK >= 1.4.2 and < 2.6.2 whose Python code calls qiskit.qpy.load() on QPY files they did not produce, such as shared circuits, downloaded files, or files from other users on the same machine. Code that never loads QPY files, or only loads your own, is not exposed. Upgrade to 2.6.2.","tier":"B","verified":{"fix":{"at":"2026-11-08T17:25:42Z","by":"analyst","doc":"https://github.com/Qiskit/qiskit/security/advisories/GHSA-vmvm-99w5-56j6","run_id":2205},"products":{"at":"2026-11-08T17:25:42Z","by":"analyst","doc":"https://github.com/Qiskit/qiskit/security/advisories/GHSA-vmvm-99w5-56j6","run_id":2205},"mitigations":{"at":"2026-11-08T17:25:42Z","by":"analyst","doc":"https://github.com/Qiskit/qiskit/security/advisories/GHSA-vmvm-99w5-56j6","run_id":2205},"how_to_check":{"at":"2026-11-08T17:25:42Z","by":"analyst","doc":"https://github.com/Qiskit/qiskit/security/advisories/GHSA-vmvm-99w5-56j6","run_id":2205},"who_affected":{"at":"2026-11-08T17:25:42Z","by":"analyst","doc":"https://github.com/Qiskit/qiskit/security/advisories/GHSA-vmvm-99w5-56j6","run_id":2205}},"analyst_revisit_at":null,"fix_status":"available","audience":"developers","plain_action":null,"pkeys":["qiskit"],"ptokens":["qiskit"],"labels":["deserialization","high","package","python","qiskit","qpy","quantum"],"campaign_type":null,"search_a":"'-116499':17A,20A '-2026':16A,19A '13':9A 'attack':13A 'code':14A 'craft':5A 'cve':15A,18A 'file':7A 'format':8A 'load':3A 'qiskit':1A,21A 'qiskit.qpy.load':11A 'qpi':6A 'run':12A 'sdk':2A","search_b":"'13':37B '2.6.2':60B 'attack':72B 'carri':39B 'code':41B 'craft':29B 'cvss':82B 'deseri':22B,68B 'file':31B 'fix':56B 'format':35B 'ibm':51B 'interact':78B 'intern':66B 'load':47B 'local':71B 'longer':63B 'maintain':55B 'older':34B 'packag':23B 'payload':70B 'per':80B 'privileg':75B 'process':46B 'python':24B,40B 'qiskit':25B,54B,59B 'qiskit.qpy.load':50B 'qpi':26B,30B 'quantum':27B 'requir':79B 'run':43B 'sympi':65B 'use':64B 'user':77B 'vector':73B,83B 'version':36B","search_c":"'1.4.2':87C '2.6.2':89C 'allow':91C 'arbitrari':97C 'attack':94C 'code':98C 'could':90C 'data':104C 'deseri':101C 'due':99C 'execut':96C 'ibm':84C 'local':93C 'qiskit':85C 'sdk':86C 'untrust':103C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-08T17:16:36+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cvss_by":"psirt@us.ibm.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-116499","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-116499","severity":null,"published_at":"2026-11-08T17:16:36+00:00","modified_at":"2026-11-08T17:16:36+00:00","first_seen_at":"2026-11-08T17:22:01+00:00","fetched_at":"2026-11-08T17:22:01+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-116499:2205","url":"https://www.ibm.com/support/pages/node/7295238","severity":null,"published_at":"2026-11-08T17:25:42+00:00","modified_at":"2026-11-08T17:25:42+00:00","first_seen_at":"2026-11-08T17:25:42+00:00","fetched_at":"2026-11-08T17:25:42+00:00","note":"Read IBM bulletin 7295238 and GHSA-vmvm-99w5-56j6: path is qiskit.qpy.load() on QPY format < 13; fixed 2.6.2. IBM range says through 2.6.2 but fix is 2.6.2; GHSA says <=2.6.1, used that. IBM lists no workarounds. Not exploited, no PoC found. X not checked.","cites":["https://www.ibm.com/support/pages/node/7295238","https://github.com/Qiskit/qiskit/security/advisories/GHSA-vmvm-99w5-56j6"]}],"documents":[{"id":102713,"url":"https://www.ibm.com/support/pages/node/7295238","title":"IBM Security Bulletin: Arbitrary Code Execution in Qiskit SDK QPY Deserialization < 13","kind":"vendor","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":102714,"url":"https://github.com/Qiskit/qiskit/security/advisories/GHSA-vmvm-99w5-56j6","title":"GHSA-vmvm-99w5-56j6: Arbitrary code execution deserializing QPY format versions < 13","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}