Analysis
No analysis available yet.
Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).
| Vendor | Product | Default status | Versions | ||||||
|---|---|---|---|---|---|---|---|---|---|
| IBM | Qiskit SDK | affected |
|
No data.
No data.
No data available yet.
Vendor Solution
Remediation/Fixes guidance: The issue is addressed in Qiskit versions v2.6.2. This version is patched to detect this situation and write out a sentinel value to identify the instruction is in an inconsistent state. Product(s)Version(s) number and/or range Remediation/Fix/Instructions< Qiskit SDK https://github.com/qiskit/qiskit - qk_circuit_inst_unitary() function>v2.6.2 Upgrade to the patched versions: qiskit v2.6.2.
Vendor Workaround
Workarounds/Mitigation guidance: None
Tracking
Sign in to view the affected projects.
No advisories yet.
| Link | Providers |
|---|---|
| https://www.ibm.com/support/pages/node/7295237 |
|
Sun, 08 Nov 2026 17:15:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | IBM Qiskit SDK 2.4.0 through 2.6.1 could allow a local attacker to execute arbitrary code due to an out-of-bounds write caused by improper input validation when accessing a corrupted unitary matrix. | |
| Title | Qiskit SDK C API may trigger an out of bounds write on accessing the unitary matrix with qk_circuit_inst_unitary(). | |
| First Time appeared |
Ibm
Ibm qiskit Sdk |
|
| Weaknesses | CWE-787 | |
| CPEs | cpe:2.3:a:ibm:qiskit_sdk:2.4.0:*:*:*:*:*:*:* cpe:2.3:a:ibm:qiskit_sdk:2.6.1:*:*:*:*:*:*:* |
|
| Vendors & Products |
Ibm
Ibm qiskit Sdk |
|
| References |
| |
| Metrics |
cvssV3_1
|
MITRE
Status: PUBLISHED
Assigner: ibm
Published:
Updated: 2026-11-08T17:05:18.090Z
Reserved: 2026-10-26T13:00:27.919Z
Link: CVE-2026-116501
Vulnrichment
No data.
NVD
Status : Awaiting Analysis
Published: 2026-11-08T17:16:37.143
Modified: 2026-11-08T17:16:37.250
Link: CVE-2026-116501
Redhat
No data.
OpenCVE Enrichment
No data.
-
CWE-787
Out-of-bounds Write