{"id":"CVE-2026-116501","published":"2026-11-08T17:16:37.143","lastModified":"2026-11-10T05:17:57.560","description":"IBM Qiskit SDK 2.4.0 through 2.6.1 could allow a local attacker to execute arbitrary code due to an out-of-bounds write caused by improper input validation when accessing a corrupted unitary matrix.","cvssScore":8.4,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cwes":["CWE-787"],"vendors":[],"products":[],"references":[{"url":"https://www.ibm.com/support/pages/node/7295237","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"IBM Qiskit SDK versions 2.4.0 through 2.6.1 contain an out-of-bounds write vulnerability (CWE-787) when processing corrupted unitary matrix inputs, enabling local attackers to execute arbitrary code via improper input validation. The flaw is exploitable locally with no privileges required and no user interaction.","exploitability":"Exploitation requires local access to the system running the affected Qiskit SDK version and a malicious or corrupted unitary matrix input; no remote exploitation is possible due to the CVSS vector (AV:L).","blast_radius":"Successful exploitation allows full compromise of the affected system—confidentiality, integrity, and availability impacts are all high—potentially enabling full system takeover by a local attacker.","remediation":"Upgrade to IBM Qiskit SDK version 2.6.2 or later, as this is the first fixed version addressing CVE-2026-116501.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["out-of-bounds-write","local-rce","input-validation-failure"],"model":"garnet-coder","analyzedAt":"2026-11-10T09:50:39.680Z"}}