CVE-2026-116500 in Qiskit SDK
Summary
by MITRE • 11/08/2026
IBM Qiskit SDK 2.4.0 through 2.6.1 could allow a local attacker to cause a denial of service due to unbound recursion during deserialization of untrusted QPY payloads.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 11/08/2026
The vulnerability identified in IBM Qiskit SDK versions 2.4.0 through 2.6.1 represents a critical security flaw rooted in the improper handling of serialized quantum circuit data, specifically within the QPY format parser. This issue manifests as an unbounded recursion error during the deserialization process when processing maliciously crafted or corrupted input files. The core technical failure lies in the lack of depth limits or structural validation checks on recursive data structures inherent to complex quantum circuits represented in QPY payloads. When a local attacker provides a payload designed with deeply nested circuit definitions, loops, or circular references that are not properly bounded by the deserialization engine, the application enters an infinite recursion loop. This behavior consumes system resources exponentially until the call stack is exhausted, resulting in a crash of the Python interpreter hosting the Qiskit environment.
From a technical perspective, this flaw aligns with CWE-675, which describes operations on data with insufficiently bounded recursion depth. The vulnerability exploits the trust placed in local file inputs by assuming that any QPY payload provided to the SDK is benign and structurally sound. However, because Python's default stack size is limited, an attacker can craft a relatively small but deeply nested circuit definition that triggers this limit rapidly. This mechanism allows for a straightforward denial of service attack without requiring remote network access or complex exploitation techniques beyond file system interaction. The impact is immediate and severe for any workflow relying on automated processing of quantum circuits, as the sudden termination of the process disrupts computational jobs, interrupts research pipelines, and potentially leads to data loss if unsaved state exists in memory at the time of the crash.
The operational impact extends beyond simple application instability. In environments where Qiskit is used for batch processing or integrated into larger scientific computing workflows, such a denial of service can cause significant delays and resource wastage. If this vulnerability were present in a shared computational environment, an attacker could potentially exhaust system memory or CPU cycles by repeatedly triggering the crash condition, thereby affecting other users on the same host. While the primary vector is local file input, the implications are broader for any application that accepts user-uploaded circuit files without rigorous sanitization and validation prior to deserialization. This highlights a common pitfall in scientific software development where performance optimizations often bypass strict security checks like recursion depth limiting or schema validation against known safe bounds.
To mitigate this vulnerability, users must upgrade immediately to IBM Qiskit SDK version 2.6.2 or later, which includes patches that enforce stricter limits on recursive operations during deserialization and validate the structural integrity of incoming QPY payloads before processing them fully. For environments where upgrading is not immediately feasible, implementing input validation layers at the application boundary is essential. This involves checking file sizes, limiting the complexity metrics of uploaded circuits such as depth or gate count, and using sandboxed execution contexts to isolate potential crashes from the main system resources. Additionally, developers should avoid deserializing untrusted data directly without first parsing it through a safe validator that checks for excessive nesting levels. Adhering to these practices aligns with general security principles regarding input validation and resource management, reducing the attack surface associated with file-based inputs in scientific computing tools.