Denial of Service Vulnerability in IBM Qiskit SDK
CVE-2026-19795

6.2MEDIUM

Key Information:

Vendor

IBM
Status
Qiskit Sdk
Vendor
CVE Published:
3 September 2026

What is CVE-2026-19795?

A vulnerability exists in IBM Qiskit SDK versions 2.1.0 through 2.5.1 that may allow a local attacker to exploit improper object handling during deserialization. Specifically, a crafted QPY payload can provoke a segmentation fault, leading to application crashes when processing untrusted input. This issue emphasizes the need for secure input management and proper deserialization practices to prevent service disruption.

Affected Version(s)

Qiskit SDK 2.1.0 <= 2.5.1

References

https://www.ibm.com/support/pages/node/7285932
vendor-advisorypatch

CVSS V3.1

Score:
6.2
Severity:
MEDIUM
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Issue discovered by Matthew Treinish (IBM) and Takashi Imamichi (IBM)
.