CVE-2026-116501
Awaiting Analysis Awaiting Analysis - Queue

Out-of-Bounds Write in IBM Qiskit SDK

Publication date: 2026-11-08

Last updated on: 2026-11-08

Assigner: IBM Corporation

Description
IBM Qiskit SDK 2.4.0 through 2.6.1 could allow a local attacker to execute arbitrary code due to an out-of-bounds write caused by improper input validation when accessing a corrupted unitary matrix.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-08
Last Modified
2026-11-08
Generated
2026-11-08
AI Q&A
2026-11-08
EPSS Evaluated
N/A
NVD
CVE-2026-116501
EUVD
EUVD-2026-119683

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
IBM Qiskit SDK From 2.4.0 (inc) to 2.6.1 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-787 The product writes data past the end, or before the beginning, of the intended buffer.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is an out-of-bounds write flaw in IBM Qiskit SDK versions 2.4.0 through 2.6.1. It occurs when the function qk_circuit_inst_unitary() accesses a corrupted unitary matrix, causing it to write more data than intended. This can lead to arbitrary code execution if a maliciously crafted QPY file is loaded.

Detection Guidance

Detecting this vulnerability requires checking the installed Qiskit SDK version. Run 'pip show qiskit' or 'conda list qiskit' to verify if your version is between 2.4.0 and 2.6.1. If so, the system is vulnerable. Additionally, inspect QPY files for corruption or unusual content as malicious files may trigger the issue.

Impact Analysis

An attacker could exploit this to execute arbitrary code locally on your system. This could allow unauthorized access, data manipulation, or system compromise if you are using an affected Qiskit SDK version.

Compliance Impact

This vulnerability could lead to unauthorized data access or modification, potentially violating GDPR (data protection) and HIPAA (health data privacy) requirements. Compliance may be compromised if systems are not patched.

Mitigation Strategies

Upgrade Qiskit SDK to version 2.6.2 or later immediately using 'pip install --upgrade qiskit' or 'conda update qiskit'. Avoid loading untrusted QPY files until the upgrade is complete. No workarounds exist, so upgrading is the only mitigation.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-116501. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...