High · 8.4 CVE-2026-116501 EUVD-2026-119683

Qiskit SDK C API may trigger an out of bounds write on accessing the unitary matrix with qk_circuit_inst_unitary().

Published Nov 8, 2026 · Updated Nov 10, 2026 · Assigned by ibm

Description

IBM Qiskit SDK 2.4.0 through 2.6.1 could allow a local attacker to execute arbitrary code due to an out-of-bounds write caused by improper input validation when accessing a corrupted unitary matrix.

Affected products

Vendor	Product	Affected	Fixed
IBM	Qiskit SDK	2.4.0 – ≤ 2.6.1	—

References

https://www.ibm.com/support/pages/node/7295237 vendor-advisory patch