IBM Qiskit SDK EUVD-2026-36575

Exploitation requires the target to invoke the vulnerable Qiskit SDK parser on attacker-controlled input on a version in the 0.43.0-2.5.0 range; no authentication or user interaction is required per CVSS PR:N/UI:N. Realistic exposure is limited to deployments where Qiskit parses untrusted data received over a network - typical examples are quantum-as-a-service APIs, multi-tenant Jupyter/notebook hubs, or CI pipelines that compile externally supplied circuits - and impact is bounded to availability of the parsing process (no code execution, data disclosure, or integrity loss). Standalone local Qiskit usage where only the operator supplies circuits is not meaningfully reachable by remote attackers despite the AV:N rating.

CVSS 7.5 (AV:N/AC:L/PR:N/UI:N/C:N/I:N/A:H) signals unauthenticated, low-complexity, network-reachable DoS with no confidentiality or integrity loss; SSVC, EPSS, and KEV data were not provided in the input. The network vector is plausible only where Qiskit parses input received over the network (e.g., a hosted notebook backend, a circuit-submission API, or a CI pipeline that compiles user-supplied circuits) - purely local SDK use limits the realistic blast radius to the calling process. With no KEV listing and no public exploit identified at time of analysis, urgency is driven by the affected version range (0.43.0-2.5.0 spans roughly two years of releases) and by deployment topology rather than active in-the-wild pressure. Note: the description does not specify the parser format (OpenQASM 2/3, QPY, or other), so operators should verify which ingestion paths in their stack are vulnerable.

An attacker submits a maliciously crafted circuit definition (e.g., a deeply nested OpenQASM file) to a hosted Qiskit-backed service such as a circuit-compilation API, shared notebook server, or research portal that parses user-supplied input. The parser recurses until the stack is exhausted, the Python process segfaults, and the service becomes unavailable to other tenants until it is restarted; no public exploit identified at time of analysis, but the AC:L/PR:N profile means a working trigger is straightforward to construct once the vulnerable production is reverse-engineered.