{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/cpes/cpe2.3aibmqiskit/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:ibm:qiskit:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":8.4,"id":"CVE-2026-116501"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Qiskit SDK (2.4.0-2.6.1)"],"_cs_severities":["high"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":["IBM"],"content_html":"\u003cp\u003eIBM Qiskit SDK versions 2.4.0 through 2.6.1 contain an out-of-bounds write vulnerability (CVE-2026-116501) that can result in arbitrary code execution. The vulnerability is triggered during the processing of a corrupted unitary matrix, which occurs due to improper input validation within the SDK. This flaw allows a local attacker to potentially execute arbitrary code within the application's runtime context.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation could allow a local attacker to execute arbitrary code within the memory space of the process utilizing the vulnerable Qiskit SDK, potentially leading to unauthorized data access or full control over the process execution environment.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eInventory systems and applications currently utilizing IBM Qiskit SDK to identify versions within the 2.4.0 to 2.6.1 range.\u003c/li\u003e\n\u003cli\u003eUpdate all instances of IBM Qiskit SDK to the latest available patched version provided by IBM.\u003c/li\u003e\n\u003cli\u003eRestrict access to files or data sources that provide input (specifically unitary matrices) to Qiskit-based applications to prevent the processing of malicious or corrupted data.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-11-08T19:35:07Z","date_published":"2026-11-08T19:35:07Z","id":"https://feed.craftedsignal.io/briefs/2026-11-qiskit-rce/","summary":"IBM Qiskit SDK versions 2.4.0 through 2.6.1 are vulnerable to arbitrary code execution due to an out-of-bounds write flaw caused by improper input validation when processing corrupted unitary matrices.","title":"IBM Qiskit SDK: Arbitrary code execution via corrupted unitary matrix (CVE-2026-116501)","url":"https://feed.craftedsignal.io/briefs/2026-11-qiskit-rce/"}],"language":"en","title":"CraftedSignal Threat Feed - Cpe:2.3:a:ibm:qiskit:*:*:*:*:*:*:*:*","version":"https://jsonfeed.org/version/1.1"}