IBM Qiskit SDK: Arbitrary code execution via deserialization (CVE-2026-116499)

IBM Qiskit SDK versions 1.4.2 through 2.6.2 are affected by a deserialization of untrusted data vulnerability (CVE-2026-116499). A local attacker who can influence the data processed by the SDK may achieve arbitrary code execution. As of the initial disclosure, no specific exploit path or proof-of-concept code has been detailed by the vendor.

Impact

An attacker with local access to a system running an affected version of Qiskit may be able to execute arbitrary commands, potentially leading to unauthorized data access or privilege escalation depending on the privileges of the application using the SDK.

Recommendation

• Identify all systems and environments utilizing IBM Qiskit SDK versions 1.4.2 through 2.6.2.
• Upgrade to a non-vulnerable version of Qiskit SDK as soon as an update is released by IBM.
• Implement strict input validation for any data processed or deserialized by Qiskit components to mitigate the risk until patches are applied.