CVE-2026-116500: Unbound Recursion in QPY deserialization can lead to denial of service

Q: Who is exposed to this issue?

Systems using IBM Qiskit SDK versions 2.4.0 through 2.6.1 are exposed when they deserialize untrusted QPY payloads. The attack is local, so the attacker must be able to cause such a payload to be processed on the affected system.

Q: What does an attacker need to do to trigger the denial of service?

The attacker needs to provide a crafted untrusted QPY payload for deserialization. Exploitation relies on unbound recursion during deserialization and can cause a denial of service.

Published Nov 5, 2026

Updated

IBM Qiskit SDK 2.4.0 through 2.6.1 could allow a local attacker to cause a denial of service due to unbound recursion during deserialization of untrusted QPY payloads.

Other sources

Qiskit SDK could allow a local attacker to cause a denial of service due to unbound recursion during deserialization of untrusted QPY payloads.

— IBM

Affected Software

1 affected component

IBM Qiskit SDK<=v2.4.0-v2.6.1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade qiskit/qiskit to a version that resolves this vulnerability.
Fixed in 2.6.2

Event History

Nov 5, 2026

CVE Published

via IBM·12:00 AM

Data Sourced

via IBM·12:00 AM

DescriptionAffected Software

Nov 8, 2026

CVE Published

via MITRE·05:04 PM

Data Sourced

via MITRE·05:04 PM

RemedyDescriptionSeverityWeakness

Data Sourced

via NVD·05:16 PM

DescriptionSeverityWeakness

Parent advisories

This vulnerability appears in the following advisories.

IBM-7295235

Frequently Asked Questions

Who is exposed to this issue?

Systems using IBM Qiskit SDK versions 2.4.0 through 2.6.1 are exposed when they deserialize untrusted QPY payloads. The attack is local, so the attacker must be able to cause such a payload to be processed on the affected system.

What does an attacker need to do to trigger the denial of service?

The attacker needs to provide a crafted untrusted QPY payload for deserialization. Exploitation relies on unbound recursion during deserialization and can cause a denial of service.

CVE-2026-116500: Unbound Recursion in QPY deserialization can lead to denial of service

Other sources

Affected Software

Remediation

Event History

Parent advisories

Frequently Asked Questions

Who is exposed to this issue?

What does an attacker need to do to trigger the denial of service?

Company

Resources

Contact

Frequently Asked Questions

Who is exposed to this issue?

What does an attacker need to do to trigger the denial of service?