CVE-2026-116500

The IBM Qiskit SDK versions v2.4.0 through v2.6.1 are vulnerable to a denial of service (DoS) due to unbound recursion during the deserialization of untrusted QPY payloads (versions >=13). A local attacker can use a maliciously crafted QPY payload to exceed the stack limit, resulting in a segm...