Security Bulletin: Qiskit SDK is vulnerable when deserializing QPY Files and may overflow the available stack space.

Summary A maliciously constructed QPY payload that contains specifically constructed ParameterExpression objects as part of the payload can trigger a segfault in the evaluation of those expressions during deserialization. The function qiskit.qpy.load may recurse too deeply and overflow the...