CVE-2026-116501 Qiskit SDK C API may trigger an out of bounds write on accessing the unitary matrix with qk_circuit_inst_unitary().

IBM Qiskit SDK 2.4.0 through 2.6.1 could allow a local attacker to execute arbitrary code due to an out-of-bounds write caused by improper input validation when accessing a corrupted unitary matrix...

CVE-2026-116501

The IBM Qiskit SDK (versions v2.4.0 through v2.6.1 ) is vulnerable to an out-of-bounds write (CWE-787) when using the C API function qk_circuit_inst_unitary() . The root cause is improper input validation when accessing a corrupted unitary matrix, which can occur if a logic fault leaves the circu...

Security Bulletin: Qiskit SDK C API may trigger an out of bounds write on accessing the unitary matrix with qk_circuit_inst_unitary().

Summary An out of bounds write could occur when using the Qiskit C API function: qkcircuitinstunitary if a logic fault left the circuit in an allowed but inconsistent state, qkcircuitinstunitary could write more data than documented. This could be potentially triggered by loading a corrupted or...