IBM Qiskit SDK CVE-2026-19795

The target application must deserialize a QPY payload sourced from an attacker-controlled or attacker-influenced input - such as a shared directory, a file upload endpoint, or an automated pipeline ingesting external quantum circuits. Local vector (AV:L) applies: the attacker must be able to place or influence the QPY file on the local filesystem or pipeline input that the target process reads. No privileges are required (PR:N per CVSS), meaning a low-privilege local user or an unauthenticated file contributor to a shared path can trigger the crash. No user interaction is needed. Exploitation is bounded entirely to availability - no path to confidentiality or integrity compromise is identified. Environments where Qiskit only deserializes internally generated QPY data are not at meaningful risk.

CVSS 6.2 with AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H accurately reflects a moderate local denial-of-service risk. The local attack vector (AV:L) confines exposure to scenarios where an attacker can introduce a malicious QPY file into a pipeline or filesystem location that the application reads from - for example, shared research environments, CI/CD pipelines processing third-party quantum circuits, or applications accepting QPY uploads. The absence of required privileges (PR:N) is notable: it suggests no authenticated session is needed to place the malicious file, increasing exposure on multi-user or automated systems. However, the impact is strictly limited to availability (crash/segfault) - no data exfiltration or code execution path is described. No KEV listing and no POC are present, and EPSS data was not provided. Real-world priority is moderate for organizations running automated Qiskit pipelines that ingest external QPY data; lower for isolated research workstations where input sources are trusted.

An attacker with access to a shared filesystem or the ability to submit files to a Qiskit-based quantum circuit processing pipeline crafts a malformed QPY file designed to trigger a segmentation fault during deserialization. When the application loads and deserializes the payload, the SDK crashes, disrupting any ongoing or queued quantum circuit processing and causing denial of service to legitimate users of the pipeline.