{"id":"CVE-2026-116500","kind":"vulnerability","aliases":["CVE-2026-116500"],"related":[],"title":"Qiskit SDK: untrusted QPY payloads crash the process via unbounded recursion","description":"IBM Qiskit SDK 2.4.0 through 2.6.1 could allow a local attacker to cause a denial of service due to unbound recursion during deserialization of untrusted QPY payloads.","summary":"IBM Qiskit SDK versions 2.4.0 through 2.6.1 recurse without a bound when deserializing QPY payloads. A local attacker who supplies a crafted QPY file can make the process fail with a denial of service.","severity":"medium","cvss":6.2,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["package","python","qiskit"],"not_affected_if":["other-versions","trusted-input-only"],"how_to_check":"- Check the installed Qiskit version with `pip show qiskit`\n- Look for code that calls Qiskit's QPY load functions on files or data from outside the team","fix":null,"status":"open","published_at":"2026-11-08T17:16:37+00:00","first_seen_at":"2026-11-08T17:22:01+00:00","triaged_at":"2026-11-08T17:24:17+00:00","updated_at":"2026-11-08T17:24:17+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-11-08T17:24:17Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"Qiskit SDK: untrusted QPY payloads crash the process via unbounded recursion","impact":"low","summary":"IBM Qiskit SDK versions 2.4.0 through 2.6.1 recurse without a bound when deserializing QPY payloads. A local attacker who supplies a crafted QPY file can make the process fail with a denial of service.","audience":"developers","category":"package","nicknames":[],"who_cares":["qiskit","python"],"confidence":0.6,"fix_status":"unknown","needs_auth":"no","worst_case":"process crashes while deserializing a crafted QPY payload","analyst_note":"Confirm the fixed Qiskit version and whether any upstream advisory or patch exists; the NVD entry alone does not state a fix.","how_to_check":"- Check the installed Qiskit version with `pip show qiskit`\n- Look for code that calls Qiskit's QPY load functions on files or data from outside the team","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["trusted-input-only","other-versions"],"who_is_affected":"Teams that run Qiskit 2.4.0 through 2.6.1 and load QPY files or payloads from untrusted sources can be hit. Systems that only load circuits they created themselves are unlikely to be exposed. The sources do not say which fixed version to move to.","user_interaction":"unknown","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000711,"input_tokens":4531,"output_tokens":516,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-116500':14A,17A '-2026':13A,16A '2.4.0':25B,58C '2.6.1':27B,60C 'allow':62C 'attack':38B,65C 'bound':31B 'caus':67C 'could':61C 'craft':42B 'crash':6A 'cve':12A,15A 'denial':52B,69C 'deseri':33B,77C 'due':72C 'fail':49B 'file':44B 'ibm':21B,55C 'local':37B,64C 'make':46B 'packag':18B 'payload':5A,35B,81C 'process':8A,48B 'python':19B 'qiskit':1A,20B,22B,56C 'qpi':4A,34B,43B,80C 'recurs':11A,28B,75C 'sdk':2A,23B,57C 'servic':54B,71C 'suppli':40B 'unbound':10A,74C 'untrust':3A,79C 'version':24B 'via':9A 'without':29B","nicknames":[],"mitigations":[],"who_affected":"Teams that run Qiskit 2.4.0 through 2.6.1 and load QPY files or payloads from untrusted sources can be hit. Systems that only load circuits they created themselves are unlikely to be exposed. The sources do not say which fixed version to move to.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"developers","plain_action":null,"pkeys":[],"ptokens":[],"labels":["medium","package","python","qiskit"],"campaign_type":null,"search_a":"'-116500':14A,17A '-2026':13A,16A 'crash':6A 'cve':12A,15A 'payload':5A 'process':8A 'qiskit':1A 'qpi':4A 'recurs':11A 'sdk':2A 'unbound':10A 'untrust':3A 'via':9A","search_b":"'2.4.0':25B '2.6.1':27B 'attack':38B 'bound':31B 'craft':42B 'denial':52B 'deseri':33B 'fail':49B 'file':44B 'ibm':21B 'local':37B 'make':46B 'packag':18B 'payload':35B 'process':48B 'python':19B 'qiskit':20B,22B 'qpi':34B,43B 'recurs':28B 'sdk':23B 'servic':54B 'suppli':40B 'version':24B 'without':29B","search_c":"'2.4.0':58C '2.6.1':60C 'allow':62C 'attack':65C 'caus':67C 'could':61C 'denial':69C 'deseri':77C 'due':72C 'ibm':55C 'local':64C 'payload':81C 'qiskit':56C 'qpi':80C 'recurs':75C 'sdk':57C 'servic':71C 'unbound':74C 'untrust':79C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-08T17:16:37+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","cvss_by":"psirt@us.ibm.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-116500","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-116500","severity":null,"published_at":"2026-11-08T17:16:37+00:00","modified_at":"2026-11-08T17:16:37+00:00","first_seen_at":"2026-11-08T17:22:01+00:00","fetched_at":"2026-11-08T17:22:01+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}