Medium · 6.2 CVE-2026-116500 EUVD-2026-119684

Unbound Recursion in QPY deserialization can lead to denial of service

Published Nov 8, 2026 · Updated Nov 12, 2026 · Assigned by ibm

Description

IBM Qiskit SDK 2.4.0 through 2.6.1 could allow a local attacker to cause a denial of service due to unbound recursion during deserialization of untrusted QPY payloads.

Affected products

Vendor	Product	Affected	Fixed
IBM	Qiskit SDK	2.4.0 – ≤ 2.6.1	—

References

https://www.ibm.com/support/pages/node/7295235 vendor-advisory patch