TI-2025-01739 Aliases CVE-2025-2000 GHSA-6m2c-76ff-6vrf

Qiskit SDK code execution

MEDIUM 50CWE-502Published 2025-03-14 · Updated 2026-02-26

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: Low
Impact type: Code execution
Confidentiality · integrity · availability: High · High · High
Fix status: Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-502.

Summary

A maliciously crafted QPY file can potential execute arbitrary-code embedded in the payload without privilege escalation when deserialising QPY formats < 13. A python process calling Qiskit 0.18.0 through 1.4.1's `qiskit.qpy.load()` function could potentially execute any arbitrary Python code embedded in the correct place in the binary file as part of specially constructed payload.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.0081 57th percentileScored 2026-11-07

Fix Fixed qiskit (PyPI): 1.4.2, 2.0.0rc2

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: Yes
Technical impact: Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
IBM	Qiskit SDK	0.18.0 – 1.4.1	—	No fix listed	CNA
—	qiskit-terra (PyPI)	0.18.0 – 0.46.3	—	No fix listed	GHSA-6m2c-76ff-6vrf
—	qiskit (PyPI)	before 1.4.2	1.4.2	Patch available	GHSA-6m2c-76ff-6vrf
—	qiskit (PyPI)	2.0.0rc1 to before 2.0.0rc2	2.0.0rc2	Patch available	GHSA-6m2c-76ff-6vrf

Qiskit SDK VendorIBM Affected 0.18.0 – 1.4.1 Fixed in — No fix listed CNA
qiskit-terra (PyPI) Vendor— Affected 0.18.0 – 0.46.3 Fixed in — No fix listed GHSA-6m2c-76ff-6vrf
qiskit (PyPI) Vendor— Affected before 1.4.2 Fixed in 1.4.2 Patch available GHSA-6m2c-76ff-6vrf
qiskit (PyPI) Vendor— Affected 2.0.0rc1 to before 2.0.0rc2 Fixed in 2.0.0rc2 Patch available GHSA-6m2c-76ff-6vrf

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:ibm:qiskit::::::php::*	0.18.0 to before 1.4.2	Vulnerable	IBM

cpe:2.3:a:ibm:qiskit:*:*:*:*:*:php:*:* Versions 0.18.0 to before 1.4.2 Vulnerable ·IBM

Remediation

Fix · GHSA-6m2c-76ff-6vrf qiskit (PyPI) Fixed in 1.4.2 Advisory →
Fix · GHSA-6m2c-76ff-6vrf qiskit (PyPI) Fixed in 2.0.0rc2 Advisory →

Timeline

2026-10-02 Threatist record created from CVE-2025-2000
2026-10-03 Alias added: GHSA-6m2c-76ff-6vrf

References

Patch 1

https://www.ibm.com/support/pages/node/7185949

Advisory 1

https://nvd.nist.gov/vuln/detail/CVE-2025-2000

Other 2

TI-2025-01206 Qiskit SDK denial of service CVSS 3.1HIGH 8.6

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences