An attacker with local access to an environment running the Qiskit SDK can supply a QPY payload that is deserialized using the legacy SymPy back‑end. The deserialization process interprets the payload and can execute arbitrary Python code, leading to full code execution on the host. This flaw stems from an insecure deserialization weakness (CWE‑502). The impact is the ability to run any code the attacker chooses, potentially subverting the system or exfiltrating data.

IBM Qiskit SDK versions 1.4.2 through 2.6.2 are vulnerable. The problem is triggered by calls to the qiskit.qpy.load() function in these releases.

The CVSS base score of 8.4 classifies the vulnerability as High severity. The EPSS score is not available, but the flaw requires local knowledge of untrusted data. It is not listed in the CISA KEV catalog. Based on the description, the likely attack vector is local. An attacker who can supply a crafted QPY file to the vulnerable function can trigger code execution, with the scope limited to the local environment where the SDK runs.