IBM Qiskit SDK 0.43.0 through 2.5.0 contains a flaw in its OpenQASM 2 parser where handling complex classical expressions can trigger uncontrolled recursion. This recursion can exceed Python’s stack limit, causing a segmentation fault that aborts the process and results in a denial of service. The vulnerability is a classic example of CWE‑674, Uncontrolled Recursion.

Vendors affected: IBM. Product: Qiskit SDK. Versions vulnerable: 0.43.0 to 2.5.0 inclusive. The issue is mitigated in Qiskit v1.4.6 and v2.4.2, which incorporate a recursion limit check.

Based on the description, the likely attack vector is the delivery of a malicious QASM file to a vulnerable SDK instance. The CVSS score of 7.5 indicates high severity, and while the EPSS score is not available, the lack of a CISA KEV listing suggests no active exploitation has been reported. Attackers only need to supply a malicious QASM file that exploits deep classical expressions; no privileged access or network exploits are required beyond delivery of the input to a vulnerable instance of the SDK. Given the high impact and straightforward exploitation path, the risk remains significant for systems that parse untrusted QASM data.