Cpe:2.3:a:ibm:qiskit:*:*:*:*:*:*:*:* - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/cpes/cpe2.3aibmqiskit/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioSun, 08 Nov 2026 19:35:07 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgIBM Qiskit SDK: Arbitrary code execution via corrupted unitary matrix (CVE-2026-116501)https://feed.craftedsignal.io/briefs/2026-11-qiskit-rce/Sun, 08 Nov 2026 19:35:07 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-11-qiskit-rce/IBM Qiskit SDK versions 2.4.0 through 2.6.1 are vulnerable to arbitrary code execution due to an out-of-bounds write flaw caused by improper input validation when processing corrupted unitary matrices.IBM Qiskit SDK versions 2.4.0 through 2.6.1 contain an out-of-bounds write vulnerability (CVE-2026-116501) that can result in arbitrary code execution. The vulnerability is triggered during the processing of a corrupted unitary matrix, which occurs due to improper input validation within the SDK. This flaw allows a local attacker to potentially execute arbitrary code within the application's runtime context.

Impact

Successful exploitation could allow a local attacker to execute arbitrary code within the memory space of the process utilizing the vulnerable Qiskit SDK, potentially leading to unauthorized data access or full control over the process execution environment.

Recommendation

  • Inventory systems and applications currently utilizing IBM Qiskit SDK to identify versions within the 2.4.0 to 2.6.1 range.
  • Update all instances of IBM Qiskit SDK to the latest available patched version provided by IBM.
  • Restrict access to files or data sources that provide input (specifically unitary matrices) to Qiskit-based applications to prevent the processing of malicious or corrupted data.
]]>highadvisory