---
id: "CVE-2026-116499"
page: "https://infrastack.ai/live/CVE-2026-116499"
kind: "vulnerability"
aliases: ["CVE-2026-116499"]
title: "Qiskit SDK: loading a crafted QPY file (format < 13) with qiskit.qpy.load() runs attacker code"
severity: "high"
cvss: 8.4
epss: null
exploited: false
status: "open"
category: "package"
products: [{"name": "qiskit", "fixed": ["2.6.2"], "affected": ">= 1.4.2, < 2.6.2", "ecosystem": "pypi"}]
ecosystems: []
tags: ["deserialization", "package", "python", "qiskit", "qpy", "quantum"]
not_affected_if: ["no-qpy-load", "no-untrusted-input", "outside-version-range"]
published_at: "2026-11-08T17:16:36+00:00"
first_seen_at: "2026-11-08T17:22:01+00:00"
updated_at: "2026-11-08T17:25:42+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-116499", "first_seen_at": "2026-11-08T17:22:01+00:00"}, {"source": "analyst", "url": "https://www.ibm.com/support/pages/node/7295238", "first_seen_at": "2026-11-08T17:25:42+00:00", "cites": ["https://www.ibm.com/support/pages/node/7295238", "https://github.com/Qiskit/qiskit/security/advisories/GHSA-vmvm-99w5-56j6"]}]
exploit_sources: []
---

# Qiskit SDK: loading a crafted QPY file (format < 13) with qiskit.qpy.load() runs attacker code

Link for people: https://infrastack.ai/live/CVE-2026-116499 (this .md is for agents)

A crafted QPY file in an older format (version < 13) can carry Python code that runs when a process loads it with qiskit.qpy.load(). IBM and the Qiskit maintainers fixed it in Qiskit 2.6.2 by no longer using SymPy internally when deserializing those payloads. Local attack vector, no privileges or user interaction required per the CVSS vector.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- pypi:qiskit affected >= 1.4.2, < 2.6.2 fixed 2.6.2

## How to check

- Run `pip show qiskit`; versions >= 1.4.2 and < 2.6.2 are affected (IBM's bulletin lists v1.4.2-v2.6.2 but names 2.6.2 as the patched release; GitHub advisory says <= 2.6.1).
- Search your code for `qiskit.qpy.load(` / `qpy.load` and check whether the QPY files come from outside your control (downloads, shared storage, other users). Only QPY format versions < 13 are the exploitable path.
- No workaround is listed by IBM; do not load QPY files from untrusted sources until upgraded.

## Fix

Upgrade qiskit to 2.6.2 or later (pip install -U 'qiskit>=2.6.2').

## Timeline

- 2026-11-08T17:22:01+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-116499
- 2026-11-08T17:25:42+00:00 analyst https://www.ibm.com/support/pages/node/7295238 — Read IBM bulletin 7295238 and GHSA-vmvm-99w5-56j6: path is qiskit.qpy.load() on QPY format < 13; fixed 2.6.2. IBM range says through 2.6.2 but fix is 2.6.2; GHSA says <=2.6.1, used that. IBM lists no workarounds. Not exploited, no PoC found. X not checked.

## Documents

- [advisory] IBM Security Bulletin: Arbitrary Code Execution in Qiskit SDK QPY Deserialization < 13 https://www.ibm.com/support/pages/node/7295238
- [advisory] GHSA-vmvm-99w5-56j6: Arbitrary code execution deserializing QPY format versions < 13 https://github.com/Qiskit/qiskit/security/advisories/GHSA-vmvm-99w5-56j6

## From the sources

IBM Qiskit SDK 1.4.2 through 2.6.2 could allow a local attacker to execute arbitrary code due to deserialization of untrusted data.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_