CVE-2026-116501: Qiskit SDK C API may trigger an out of bounds write on accessing the unitary matrix with qk_circuit_inst_unitary().

Q: Who is exposed to this issue?

Systems using IBM Qiskit SDK versions 2.4.0 through 2.6.1 are affected. Exploitation is local, so an attacker needs the ability to execute code or otherwise act locally on the system using the vulnerable SDK.

Q: What conditions are required for exploitation?

The issue is triggered when qk_circuit_inst_unitary() accesses a corrupted unitary matrix. The vulnerable input validation can lead to an out-of-bounds write and arbitrary code execution.

Q: What is the potential impact?

A local attacker may be able to execute arbitrary code. The assigned vector indicates high impacts to confidentiality, integrity, and availability.

Published Nov 5, 2026

Updated

IBM Qiskit SDK 2.4.0 through 2.6.1 could allow a local attacker to execute arbitrary code due to an out-of-bounds write caused by improper input validation when accessing a corrupted unitary matrix.

Other sources

Qiskit SDK could allow a local attacker to execute arbitrary code due to an out-of-bounds write caused by improper input validation when accessing a corrupted unitary matrix

— IBM

Affected Software

1 affected component

IBM Qiskit SDK<=v2.4.0 - v2.6.1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade qiskit/qiskit to a version that resolves this vulnerability.
Fixed in 2.6.2

Event History

Nov 5, 2026

CVE Published

via IBM·12:00 AM

Data Sourced

via IBM·12:00 AM

DescriptionAffected Software

Nov 8, 2026

CVE Published

via MITRE·05:05 PM

Data Sourced

via MITRE·05:05 PM

RemedyDescriptionSeverityWeakness

Data Sourced

via NVD·05:16 PM

DescriptionSeverityWeakness

Parent advisories

This vulnerability appears in the following advisories.

IBM-7295237

Frequently Asked Questions

Who is exposed to this issue?

Systems using IBM Qiskit SDK versions 2.4.0 through 2.6.1 are affected. Exploitation is local, so an attacker needs the ability to execute code or otherwise act locally on the system using the vulnerable SDK.

What conditions are required for exploitation?

The issue is triggered when qk_circuit_inst_unitary() accesses a corrupted unitary matrix. The vulnerable input validation can lead to an out-of-bounds write and arbitrary code execution.

What is the potential impact?

A local attacker may be able to execute arbitrary code. The assigned vector indicates high impacts to confidentiality, integrity, and availability.

CVE-2026-116501: Qiskit SDK C API may trigger an out of bounds write on accessing the unitary matrix with qk_circuit_inst_unitary().

Other sources

Affected Software

Remediation

Event History

Parent advisories

Frequently Asked Questions

Who is exposed to this issue?

What conditions are required for exploitation?

What is the potential impact?

Company

Resources

Contact

Frequently Asked Questions

Who is exposed to this issue?

What conditions are required for exploitation?

What is the potential impact?