Qiskit SDK (1.4.2-2.6.2) - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/products/qiskit-sdk-1.4.2-2.6.2/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioSun, 08 Nov 2026 21:26:38 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgIBM Qiskit SDK: Arbitrary code execution via deserialization (CVE-2026-116499)https://feed.craftedsignal.io/briefs/2026-11-qiskit-rce-2a04f3dc/Sun, 08 Nov 2026 21:26:38 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-11-qiskit-rce-2a04f3dc/IBM Qiskit SDK versions 1.4.2 through 2.6.2 contain a deserialization vulnerability that allows a local attacker to execute arbitrary code within the host environment.IBM Qiskit SDK versions 1.4.2 through 2.6.2 are affected by a deserialization of untrusted data vulnerability (CVE-2026-116499). A local attacker who can influence the data processed by the SDK may achieve arbitrary code execution. As of the initial disclosure, no specific exploit path or proof-of-concept code has been detailed by the vendor.

Impact

An attacker with local access to a system running an affected version of Qiskit may be able to execute arbitrary commands, potentially leading to unauthorized data access or privilege escalation depending on the privileges of the application using the SDK.

Recommendation

  • Identify all systems and environments utilizing IBM Qiskit SDK versions 1.4.2 through 2.6.2.
  • Upgrade to a non-vulnerable version of Qiskit SDK as soon as an update is released by IBM.
  • Implement strict input validation for any data processed or deserialized by Qiskit components to mitigate the risk until patches are applied.
]]>highadvisorydeserializationrcepythondeveloper-tools