Advisory · CVE-2026-116501
IBM Qiskit SDK can run code from a corrupted unitary matrix
IBM Qiskit SDK 2.4.0 through 2.6.1 could allow a local attacker to execute arbitrary code due to an out-of-bounds write caused by improper input validation when accessing a corrupted unitary matrix, rated high at CVSS 8.4.
- Vendor
- IBM
- Product
- Qiskit SDK
- Identifier / CWE
- CVE-2026-116501
CWE-787 - Action timing
- Immediate
Explain it like I’m five
Qiskit works with unitary matrices that describe quantum operations. If the matrix data is corrupted, weak input checks let the code write past its buffer, and a local attacker can turn that memory corruption into running their code.
- 01Corrupted matrix supplied
A local attacker supplies a corrupted unitary matrix.
- 02Validation skipped
Input validation fails when accessing the matrix.
- 03Out-of-bounds write
Memory past the intended buffer is overwritten.
- 04Code executed
The memory corruption leads to arbitrary code execution.
What happened
IBM Qiskit SDK 2.4.0 through 2.6.1 could allow a local attacker to execute arbitrary code due to an out-of-bounds write caused by improper input validation when accessing a corrupted unitary matrix. The record rates it high at CVSS 8.4 under version 3.1, with local attack vector, low complexity, no privileges required, and no user interaction.
IBM’s bulletin lists the affected versions and the fix. Corrupted input data is a realistic input for a scientific library that loads files from collaborators.
What to do
- Inventory Qiskit SDK installations and record each version.
- Check the IBM bulletin for the fix and apply it.
- Avoid loading matrix data from untrusted sources.
- Verify the deployed version after updating.
Management note
A corrupted data file that leads to code execution is a supply-chain-shaped problem for shared research data. Patch and validate inputs.