CVE-2026-19795

IBM Qiskit SDK versions 2.1.0 through 2.5.1 are vulnerable to a denial of service when deserializing QPY files . The root cause is improper handling of a specially crafted object during deserialization, which may overflow the available stack space and trigger a segmentation fault , crashing the a...

GHSA-3PWP-2FQJ-6G2P Duplicate Advisory: Qiskit allows arbitrary code execution decoding QPY format versions < 13

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-6m2c-76ff-6vrf. This link is maintained to preserve external references. Original Description A maliciously crafted QPY file can potential execute arbitrary-code embedded in the payload without privilege...