CVE-2026-116499: Arbitrary Code Execution in Qiskit SDK QPY Deserialization

Q: Who is exposed to this vulnerability?

Users of IBM Qiskit SDK versions 1.4.2 through 2.6.2 are exposed when they deserialize untrusted QPY data. Exploitation is local and does not require privileges or user interaction according to the supplied vector.

Q: What does an attacker need to exploit it?

An attacker needs a way to cause untrusted serialized data to be deserialized by the affected Qiskit SDK. The vulnerability can then allow arbitrary code execution.

Q: How severe is successful exploitation?

Successful exploitation can result in high impact to confidentiality, integrity, and availability. The supplied severity score is 8.4 (High).

Published Nov 5, 2026

Updated

IBM Qiskit SDK 1.4.2 through 2.6.2 could allow a local attacker to execute arbitrary code due to deserialization of untrusted data.

Other sources

Qiskit SDK could allow a local attacker to execute arbitrary code due to deserialization of untrusted data.

— IBM

Affected Software

1 affected component

IBM Qiskit SDK<=v1.4.2-v2.6.2

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade qiskit/qiskit to a version that resolves this vulnerability.
Fixed in 2.6.2

Event History

Nov 5, 2026

CVE Published

via IBM·12:00 AM

Data Sourced

via IBM·12:00 AM

DescriptionAffected Software

Nov 8, 2026

CVE Published

via MITRE·05:03 PM

Data Sourced

via MITRE·05:03 PM

RemedyDescriptionSeverityWeakness

Data Sourced

via NVD·05:16 PM

DescriptionSeverityWeakness

Parent advisories

This vulnerability appears in the following advisories.

IBM-7295238

Frequently Asked Questions

Who is exposed to this vulnerability?

Users of IBM Qiskit SDK versions 1.4.2 through 2.6.2 are exposed when they deserialize untrusted QPY data. Exploitation is local and does not require privileges or user interaction according to the supplied vector.

What does an attacker need to exploit it?

An attacker needs a way to cause untrusted serialized data to be deserialized by the affected Qiskit SDK. The vulnerability can then allow arbitrary code execution.

How severe is successful exploitation?

Successful exploitation can result in high impact to confidentiality, integrity, and availability. The supplied severity score is 8.4 (High).

CVE-2026-116499: Arbitrary Code Execution in Qiskit SDK QPY Deserialization

Other sources

Affected Software

Remediation

Event History

Parent advisories

Frequently Asked Questions

Who is exposed to this vulnerability?

What does an attacker need to exploit it?

How severe is successful exploitation?

Company

Resources

Contact

Frequently Asked Questions

Who is exposed to this vulnerability?

What does an attacker need to exploit it?

How severe is successful exploitation?