High · 8.4 CVE-2026-116499 EUVD-2026-119685

Arbitrary Code Execution in Qiskit SDK QPY Deserialization

Published Nov 8, 2026 · Updated Nov 10, 2026 · Assigned by ibm

Description

IBM Qiskit SDK 1.4.2 through 2.6.2 could allow a local attacker to execute arbitrary code due to deserialization of untrusted data.

Vendor	Product	Affected	Fixed
IBM	Qiskit SDK	1.4.2 – ≤ 2.6.2	—