Analysis
Analysis and contextual insights are available on OpenCVE Cloud.
Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).
| Vendor | Product | Default status | Versions | ||||||
|---|---|---|---|---|---|---|---|---|---|
| IBM | Qiskit SDK | affected |
|
No data.
No data.
No data available yet.
Vendor Solution
Remediation/Fixes guidance: The issue is addressed in Qiskit versions v2.6.2. Product(s)Version(s) number and/or range Remediation/Fix/Instructions< Qiskit SDK https://github.com/qiskit/qiskit - qiskit.qpy.load() function>v2.6.2 Upgrade to the patched versions: qiskit v2.6.2.
Vendor Workaround
Workarounds/Mitigation guidance: None
Tracking
Sign in to view the affected projects.
No advisories yet.
| Link | Providers |
|---|---|
| https://www.ibm.com/support/pages/node/7295235 |
|
Sun, 08 Nov 2026 17:15:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | IBM Qiskit SDK 2.4.0 through 2.6.1 could allow a local attacker to cause a denial of service due to unbound recursion during deserialization of untrusted QPY payloads. | |
| Title | Unbound Recursion in QPY deserialization can lead to denial of service | |
| First Time appeared |
Ibm
Ibm qiskit Sdk |
|
| Weaknesses | CWE-502 | |
| CPEs | cpe:2.3:a:ibm:qiskit_sdk:2.4.0:*:*:*:*:*:*:* cpe:2.3:a:ibm:qiskit_sdk:2.6.1:*:*:*:*:*:*:* |
|
| Vendors & Products |
Ibm
Ibm qiskit Sdk |
|
| References |
| |
| Metrics |
cvssV3_1
|
MITRE
Status: PUBLISHED
Assigner: ibm
Published:
Updated: 2026-11-08T17:04:53.713Z
Reserved: 2026-10-26T12:59:16.329Z
Link: CVE-2026-116500
Vulnrichment
No data.
NVD
Status : Awaiting Analysis
Published: 2026-11-08T17:16:37.007
Modified: 2026-11-08T17:16:37.113
Link: CVE-2026-116500
Redhat
No data.
OpenCVE Enrichment
No data.
-
CWE-502
Deserialization of Untrusted Data