Qiskit SDK is vulnerable when deserializing QPY Files and may overflow the available stack space.
Summary
| CVE | CVE-2026-19795 |
|---|---|
| State | PUBLISHED |
| Assigner | ibm |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2026-09-03 20:17:19 UTC |
| Updated | 2026-09-04 21:17:24 UTC |
| Description | Qiskit could allow a local attacker to cause a denial of service due to a stack overflow during deserialization of QPY payloads. A malicious QPY payload can trigger a segmentation fault, causing the application to crash when deserializing untrusted input. |
Risk And Classification
Primary CVSS: v3.1 6.2 MEDIUM from [email protected]
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
EPSS: 0.001120000 probability, percentile 0.015230000 (date 2026-09-04)
Problem Types: CWE-502 | CWE-502 CWE-502 Deserialization of Untrusted Data
| Version | Source | Type | Score | Severity | Vector |
|---|---|---|---|---|---|
| 3.1 | [email protected] | Secondary | 6.2 | MEDIUM | CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
| 3.1 | CNA | CVSS | 6.2 | MEDIUM | CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
CVSS v3.1 Breakdown
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Vendor Declared Affected Products
| Source | Vendor | Product | Version | Platforms |
|---|---|---|---|---|
| CNA | IBM | Qiskit SDK | affected 2.1.0 2.5.1 semver | Not specified |
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| www.ibm.com/support/pages/node/7285932 | [email protected] | www.ibm.com | |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
Vendor Comments And Credit
Discovery Credit
CNA: Issue discovered by Matthew Treinish (IBM) and Takashi Imamichi (IBM) (en)
Additional Advisory Data
Solutions
CNA: Remediation/Fixes guidance: The issue is addressed in Qiskit versions v2.5.2. This version is patched to prevent the stack overflow by no longer evaluating the expression tree for ParameterExpression objects recursively. Product(s)Version(s) number and/or range Remediation/Fix/Instructions<Qiskit SDK - qiskit.qpy.load() function>v2.5.2 Upgrade to the patched versions: qiskit v2.5.2.
Workarounds
CNA: Workarounds/Mitigation guidance: None