Quick answers
- Is CVE-2026-116501 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-116501 being exploited in the wild.
- How severe is CVE-2026-116501?
- High severity, with a CVSS score of 8.4, published 8 November 2026.
- Which products and versions are affected?
- IBM Qiskit SDK 2.4.0 through 2.6.1.
- Is there a fix for CVE-2026-116501?
- Yes: fixed in Qiskit SDK v2.6.2. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-116501 attacked?
- It is attacked with local access, in a software library.
- Am I affected by CVE-2026-116501?
- Check whether you run IBM Qiskit SDK at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
How to fix
- Fixed in: Qiskit SDK v2.6.2
Technical details
An out-of-bounds write (CWE-787) exists in the qk_circuit_inst_unitary() C API function when processing a corrupted or maliciously constructed QPY file that leaves a circuit in an inconsistent state. The vulnerability stems from improper input validation that fails to detect when the unitary matrix is malformed, causing the function to write beyond allocated buffer boundaries. A local attacker can exploit this to achieve arbitrary code execution without requiring authentication or user interaction.
Affected products
- IBM Qiskit SDK 2.4.0 through 2.6.1
Timeline
- 2026-11-05: disclosed