CVE-2026-116501

Summary

IBM Qiskit SDK versions 2.4.0 through 2.6.1 contain an out-of-bounds write vulnerability (CWE-787) when processing corrupted unitary matrix inputs, enabling local attackers to execute arbitrary code via improper input validation. The flaw is exploitable locally with no privileges required and no user interaction.

Exploitability

Exploitation requires local access to the system running the affected Qiskit SDK version and a malicious or corrupted unitary matrix input; no remote exploitation is possible due to the CVSS vector (AV:L).

Blast radius

Successful exploitation allows full compromise of the affected system—confidentiality, integrity, and availability impacts are all high—potentially enabling full system takeover by a local attacker.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to IBM Qiskit SDK version 2.6.2 or later, as this is the first fixed version addressing CVE-2026-116501.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.