The vulnerability is an unbound recursion bug that occurs when the Qiskit SDK deserializes untrusted QPY payloads using the qiskit.qpy.load() function. This insecure deserialization flaw (CWE-502) can cause stack exhaustion or other resource depletion, ultimately terminating processes and denying service to legitimate users. The impact is limited to the host running the application, but it can disrupt compute workflows and any services dependent on Qiskit execution.

IBM Qiskit SDK versions 2.4.0 through 2.6.1 are affected. The vulnerability has been addressed in the patched release v2.6.2 and later. Products impacted include the Qiskit SDK from IBM. No additional operating system or platform details are specified, so the risk applies to any environment where the affected Qiskit SDK is installed.

The CVSS score of 6.2 classifies the issue as medium severity, and the EPSS score is not available, indicating no current publicly observed exploitation probability. The CVE is not listed in the CISA KEV catalog. The attack vector, inferred from the description, is local: a malicious user must supply an untrusted QPY payload to a vulnerable application. While this limits widespread network exploitation, an attacker with local access can trigger a denial of service by repeatedly sending crafted payloads, exhausting resources or crashing the process.