A maliciously crafted QPY file can potential execute arbitrary-code embedded in the payload without privilege escalation when deserialising QPY formats < 13. A python process calling Qiskit 0.18.0 through 1.4.1's `qiskit.qpy.load()` function could potentially execute any arbitrary Python code embedded in the correct place in the binary file as part of specially constructed payload.
CVSS
No CVSS.
References
| Link | Resource |
|---|---|
| https://www.ibm.com/support/pages/node/7185949 | Vendor Advisory |
Configurations
History
18 Aug 2025, 18:19
| Type | Values Removed | Values Added |
|---|---|---|
| CPE | cpe:2.3:a:ibm:qiskit:*:*:*:*:*:php:*:* | |
| References | () https://www.ibm.com/support/pages/node/7185949 - Vendor Advisory | |
| CWE | ||
| First Time |
Ibm
Ibm qiskit |
|
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : unknown |
14 Mar 2025, 13:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2025-03-14 13:15
Updated : 2025-08-18 18:19
NVD link : CVE-2025-2000
Mitre link : CVE-2025-2000
JSON object : View
Products Affected
ibm
- qiskit
CWE
No CWE.