IBM Qiskit SDK: Arbitrary code execution via corrupted unitary matrix (CVE-2026-116501)
IBM Qiskit SDK versions 2.4.0 through 2.6.1 are vulnerable to arbitrary code execution due to an out-of-bounds write flaw caused by improper input validation when processing corrupted unitary matrices.
CVE search metadata
CVE search record: CVE-2026-116501. Severity: high. CVSS: 8.4. KEV: no. Product: Qiskit SDK (2.4.0-2.6.1). Brief: IBM Qiskit SDK: Arbitrary code execution via corrupted unitary matrix (CVE-2026-116501). Brief link: https://feed.craftedsignal.io/briefs/2026-11-qiskit-rce/
Triage facts
Revision 1- Applicability
- Qiskit SDK (2.4.0-2.6.1)
- Evidence
- Unknown
- Severity
- High
- Action
- Elevated
- Sources
- 1 public source
- Freshness
- Revision 1Nov 8, 19:35 UTC
- Vulnerabilities
- 1 CVE
- Source quality
- A2Roughly even chance
IBM Qiskit SDK versions 2.4.0 through 2.6.1 contain an out-of-bounds write vulnerability (CVE-2026-116501) that can result in arbitrary code execution. The vulnerability is triggered during the processing of a corrupted unitary matrix, which occurs due to improper input validation within the SDK. This flaw allows a local attacker to potentially execute arbitrary code within the application's runtime context.
Impact
Successful exploitation could allow a local attacker to execute arbitrary code within the memory space of the process utilizing the vulnerable Qiskit SDK, potentially leading to unauthorized data access or full control over the process execution environment.
Recommendation
- Inventory systems and applications currently utilizing IBM Qiskit SDK to identify versions within the 2.4.0 to 2.6.1 range.
- Update all instances of IBM Qiskit SDK to the latest available patched version provided by IBM.
- Restrict access to files or data sources that provide input (specifically unitary matrices) to Qiskit-based applications to prevent the processing of malicious or corrupted data.
Immediate actions
Identify and patch instances of IBM Qiskit SDK versions 2.4.0-2.6.1
Threat Hunt
Identify applications loading Qiskit SDK libraries and monitor for abnormal child process spawning or unexpected memory write patterns in processes linked to matrix processing tasks.
Data: Application dependency inventory logs, Endpoint process creation telemetry
Mitigations
Upgrade to the latest IBM Qiskit SDK version
CVE-2026-116501