{"id":"CVE-2026-116499","published":"2026-11-08T17:16:36.870","lastModified":"2026-11-10T05:17:50.647","description":"IBM Qiskit SDK 1.4.2 through 2.6.2 could allow a local attacker to execute arbitrary code due to deserialization of untrusted data.","cvssScore":8.4,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cwes":["CWE-502"],"vendors":[],"products":[],"references":[{"url":"https://www.ibm.com/support/pages/node/7295238","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"IBM Qiskit SDK versions 1.4.2 through 2.6.2 contain a deserialization vulnerability (CWE-502) that allows a local attacker to execute arbitrary code by deserializing untrusted data. This flaw is exploitable locally without authentication or user interaction.","exploitability":"Exploitation requires local access to the system where the vulnerable Qiskit SDK is used and the ability to supply malicious serialized data to an affected application component.","blast_radius":"Successful exploitation could lead to full compromise of the host system, including unauthorized code execution, data theft, and system modification, but only within the privileges of the local user account running the vulnerable application.","remediation":"Upgrade to IBM Qiskit SDK version 2.6.3 or later, which contains a fix for CVE-2026-116499.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["deserialization","rce","local-exploit","cwe502"],"model":"garnet-coder","analyzedAt":"2026-11-10T09:50:30.888Z"}}