Executive brief
IBM Qiskit SDK, a software development kit for quantum computing, is vulnerable to a flaw that can cause applications to crash. By providing specially crafted quantum circuit descriptions (OpenQASM), an attacker can trigger a memory error that shuts down the service. This results in a denial of service, preventing researchers or automated systems from processing quantum programs.
Technical details
A vulnerability in the OpenQASM 2 parser of the IBM Qiskit SDK (specifically within qiskit.qasm2.load, qiskit.qasm2.loads, and QuantumCircuit.from_qasm_str) allows for uncontrolled recursion. When the parser encounters deeply nested classical expressions, it can overflow the available stack space, resulting in a segmentation fault. This is a remote attack vector if the application processes user-supplied QASM strings or files without prior validation. The issue is mitigated in patched versions by enforcing the Python recursion limit and raising a standard RecursionError instead of crashing the process. Patches are available in versions 1.4.6 and 2.4.2.
Affected products
- IBM Qiskit SDK 0.43.0 - 2.5.0
Timeline
- 2026-06-12: disclosed
- 2026-06-12: advisory
- 2026-06-12: patched