CVE-2026-116499

Summary

IBM Qiskit SDK versions 1.4.2 through 2.6.2 contain a deserialization vulnerability (CWE-502) that allows a local attacker to execute arbitrary code by deserializing untrusted data. This flaw is exploitable locally without authentication or user interaction.

Exploitability

Exploitation requires local access to the system where the vulnerable Qiskit SDK is used and the ability to supply malicious serialized data to an affected application component.

Blast radius

Successful exploitation could lead to full compromise of the host system, including unauthorized code execution, data theft, and system modification, but only within the privileges of the local user account running the vulnerable application.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to IBM Qiskit SDK version 2.6.3 or later, which contains a fix for CVE-2026-116499.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.