{"id":"CVE-2026-116501","kind":"vulnerability","aliases":["CVE-2026-116501"],"related":[],"title":"Qiskit C API qk_circuit_inst_unitary() can write out of bounds; fixed in 2.6.2","description":"IBM Qiskit SDK 2.4.0 through 2.6.1 could allow a local attacker to execute arbitrary code due to an out-of-bounds write caused by improper input validation when accessing a corrupted unitary matrix.","summary":"Qiskit 2.4.0 through 2.6.1: the C API function qk_circuit_inst_unitary() can write more data than documented if a logic fault leaves a circuit in an allowed but inconsistent state. Maintainers say this could potentially be triggered by loading a corrupted or maliciously constructed QPY file. Fixed in 2.6.2.","severity":"high","cvss":8.4,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"qiskit","fixed":["2.6.2"],"affected":">= 2.4.0, <= 2.6.1","ecosystem":"pip"}],"ecosystems":[],"tags":["c-api","package","python","qiskit","qpy","quantum"],"not_affected_if":["no-c-api-use","trusted-qpy-only","version-2.6.2-or-later","version-outside-2.4.0-to-2.6.1"],"how_to_check":"- Run `pip show qiskit`; versions >= 2.4.0 and <= 2.6.1 are affected, 2.6.2 is patched.\n- Only code that calls the C API function qk_circuit_inst_unitary() is the named path; check whether you build C/C++ code against Qiskit's C API, and whether it loads QPY files from untrusted sources.","fix":"Upgrade qiskit to 2.6.2 (pip install -U 'qiskit>=2.6.2')","status":"open","published_at":"2026-11-08T17:16:37+00:00","first_seen_at":"2026-11-08T17:22:01+00:00","triaged_at":"2026-11-08T17:24:13+00:00","updated_at":"2026-11-08T17:25:44+00:00","category":"package","confidence":0.85,"triage":{"at":"2026-11-08T17:24:13Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"Qiskit SDK: corrupted unitary matrix input lets a local user run code","impact":"high","summary":"IBM's Qiskit quantum computing SDK versions 2.4.0 through 2.6.1 have an out-of-bounds write caused by weak input validation when handling a corrupted unitary matrix. A local attacker who can supply such input can execute arbitrary code.","audience":"developers","category":"package","nicknames":[],"who_cares":["qiskit","python","quantum"],"confidence":0.6,"fix_status":"unknown","needs_auth":"unknown","worst_case":"Arbitrary code runs on the local machine as the Qiskit user","analyst_note":"Check the NVD entry and IBM's security bulletin for the fixed version and any trigger conditions; the sources give no fix.","how_to_check":"- `pip show qiskit` to read the installed version and see whether it falls in 2.4.0 through 2.6.1\n- Check whether any code path feeds untrusted matrices into Qiskit on the same machine","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["version-outside-2.4.0-to-2.6.1"],"who_is_affected":"Only installations of Qiskit SDK 2.4.0 through 2.6.1 are in scope, and the attacker must already have local access to the machine. The sources do not name a specific data path that exposes it remotely. Teams that only use Qiskit with trusted local inputs are less exposed, but the sources do not say how far that reduces risk.","user_interaction":"unknown","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000741,"input_tokens":4547,"output_tokens":572,"severity_before":"high"},"analyst_status":"done","analyst_note":"Check the NVD entry and IBM's security bulletin for the fixed version and any trigger conditions; the sources give no fix.","search":"'-116501':18A,21A '-2026':17A,20A '2.4.0':32B,84C '2.6.1':34B,86C '2.6.2':15A,80B 'access':110C 'allow':58B,88C 'api':3A,25B,37B 'arbitrari':94C 'attack':91C 'bound':12A,102C 'c':2A,24B,36B 'c-api':23B 'caus':104C 'circuit':5A,40B,55B 'code':95C 'construct':75B 'corrupt':72B,112C 'could':65B,87C 'cve':16A,19A 'data':46B 'document':48B 'due':96C 'execut':93C 'fault':52B 'file':77B 'fix':13A,78B 'function':38B 'ibm':81C 'improp':106C 'inconsist':60B 'input':107C 'inst':6A,41B 'leav':53B 'load':70B 'local':90C 'logic':51B 'maintain':62B 'malici':74B 'matrix':114C 'out-of-bound':99C 'packag':26B 'potenti':66B 'python':27B 'qiskit':1A,22A,28B,31B,82C 'qk':4A,39B 'qpi':29B,76B 'quantum':30B 'say':63B 'sdk':83C 'state':61B 'trigger':68B 'unitari':7A,42B,113C 'valid':108C 'write':9A,44B,103C","nicknames":[],"mitigations":[],"who_affected":"Qiskit (pip) 2.4.0 through 2.6.1. The advisory names the C API function qk_circuit_inst_unitary(); it says the bug could potentially be triggered by loading a corrupted or maliciously constructed QPY file. Teams that use Qiskit only from Python without the C API, or only load QPY files they produced themselves, can likely skip it, though the advisory does not state this explicitly.","tier":"B","verified":{"fix":{"at":"2026-11-08T17:25:44Z","by":"analyst","doc":"https://github.com/qiskit/qiskit/releases","run_id":2204},"products":{"at":"2026-11-08T17:25:44Z","by":"analyst","doc":"https://github.com/qiskit/qiskit/releases","run_id":2204},"how_to_check":{"at":"2026-11-08T17:25:44Z","by":"analyst","doc":"https://github.com/qiskit/qiskit/releases","run_id":2204},"who_affected":{"at":"2026-11-08T17:25:44Z","by":"analyst","doc":"https://github.com/qiskit/qiskit/releases","run_id":2204}},"analyst_revisit_at":null,"fix_status":"available","audience":"developers","plain_action":null,"pkeys":["qiskit"],"ptokens":["qiskit"],"labels":["capi","high","package","python","qiskit","qpy","quantum"],"campaign_type":null,"search_a":"'-116501':18A,21A '-2026':17A,20A '2.6.2':15A 'api':3A 'bound':12A 'c':2A 'circuit':5A 'cve':16A,19A 'fix':13A 'inst':6A 'qiskit':1A,22A 'qk':4A 'unitari':7A 'write':9A","search_b":"'2.4.0':32B '2.6.1':34B '2.6.2':80B 'allow':58B 'api':25B,37B 'c':24B,36B 'c-api':23B 'circuit':40B,55B 'construct':75B 'corrupt':72B 'could':65B 'data':46B 'document':48B 'fault':52B 'file':77B 'fix':78B 'function':38B 'inconsist':60B 'inst':41B 'leav':53B 'load':70B 'logic':51B 'maintain':62B 'malici':74B 'packag':26B 'potenti':66B 'python':27B 'qiskit':28B,31B 'qk':39B 'qpi':29B,76B 'quantum':30B 'say':63B 'state':61B 'trigger':68B 'unitari':42B 'write':44B","search_c":"'2.4.0':84C '2.6.1':86C 'access':110C 'allow':88C 'arbitrari':94C 'attack':91C 'bound':102C 'caus':104C 'code':95C 'corrupt':112C 'could':87C 'due':96C 'execut':93C 'ibm':81C 'improp':106C 'input':107C 'local':90C 'matrix':114C 'out-of-bound':99C 'qiskit':82C 'sdk':83C 'unitari':113C 'valid':108C 'write':103C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-08T17:16:37+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cvss_by":"psirt@us.ibm.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-116501","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-116501","severity":null,"published_at":"2026-11-08T17:16:37+00:00","modified_at":"2026-11-08T17:16:37+00:00","first_seen_at":"2026-11-08T17:22:01+00:00","fetched_at":"2026-11-08T17:22:01+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-116501:2204","url":"https://github.com/Qiskit/qiskit/security/advisories/GHSA-5835-q8qp-whcc","severity":null,"published_at":"2026-11-08T17:25:44+00:00","modified_at":"2026-11-08T17:25:44+00:00","first_seen_at":"2026-11-08T17:25:44+00:00","fetched_at":"2026-11-08T17:25:44+00:00","note":"Read Qiskit GHSA-5835-q8qp-whcc (affected >=2.4.0,<=2.6.1, patched 2.6.2) and 2.6.2 release notes (#17418). Not exploited, no PoC seen. IBM bulletin page not fetched directly. Whether 2.4.x/2.5.x backports exist is unknown.","cites":["https://github.com/Qiskit/qiskit/security/advisories/GHSA-5835-q8qp-whcc","https://github.com/qiskit/qiskit/releases"]}],"documents":[{"id":102715,"url":"https://github.com/Qiskit/qiskit/security/advisories/GHSA-5835-q8qp-whcc","title":"GHSA-5835-q8qp-whcc: Out of bounds write on qk_circuit_inst_unitary()","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":102716,"url":"https://github.com/qiskit/qiskit/releases","title":"Qiskit 2.6.2 release (Enforce buffer overwrite safety in qk_circuit_inst_unitary #17418)","kind":"release","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"fix","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}