Qiskit SDK vulnerabilities
4 known vulnerabilities in Qiskit SDK from IBM. 4 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.
Latest first
- 8.4 High severity
Qiskit SDK: Out-of-bounds Write
IBM Qiskit SDK 2.4.0 through 2.6.1 could allow a local attacker to execute arbitrary code due to an out-of-bounds write caused by improper input validation when accessing a corrupted unitary matrix.
- 7.5 High severity
Qiskit SDK: Uncontrolled Recursion
IBM Qiskit SDK 0.43.0 through 2.5.0 could allow an attacker to trigger a segmentation fault leading to a denial of service due to uncontrolled recursion in the parser.
- 9.8 Critical severity
Qiskit SDK: Deserialization of Untrusted Data
A maliciously crafted QPY file can potential execute arbitrary-code embedded in the payload without privilege escalation when deserialising QPY formats < 13. A python process calling Qiskit 0.18.0 through 1.4.1's `qiskit.qpy.load()` function could potentially
- 8.6 High severity
Qiskit SDK: Deserialization of Untrusted Data
Qiskit SDK 0.45.0 through 1.2.4 could allow a remote attacker to cause a denial of service using a maliciously crafted QPY file containing a malformed symengine serialization stream which can cause a segfault within the symengine library.