Vulnerability · Published Mar 14, 2025 · Assigned by ibm

CVE-2025-2000Qiskit SDK code execution

Critical 9.8

In plain English

A critical-severity unsafe deserialization in Qiskit SDK from IBM. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.8% (higher than 57% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)9.8Critical

Exploit odds (30 days)0.8%top 42.9% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

A maliciously crafted QPY file can potential execute arbitrary-code embedded in the payload without privilege escalation when deserialising QPY formats < 13. A python process calling Qiskit 0.18.0 through 1.4.1's `qiskit.qpy.load()` function could potentially execute any arbitrary Python code embedded in the correct place in the binary file as part of specially constructed payload.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
PyPI	qiskit	1.4.2	GHSA-6m2c-76ff-6vrf
PyPI	qiskit	2.0.0rc2	GHSA-6m2c-76ff-6vrf
PyPI	qiskit	1.4.2, 2.0.0rc2	PYSEC-2026-510
PyPI	qiskit-terra	no fix listed	GHSA-6m2c-76ff-6vrf
PyPI	qiskit-terra	no fix listed	PYSEC-2026-511

Affected products (as reported)

Vendor	Product	Versions
IBM	Qiskit SDK	0.18.0 – through 1.4.1

Weakness: CWE-502 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References

https://www.ibm.com/support/pages/node/7185949 vendor-advisory, patch