CVE-2026-19795 — Qiskit SDK is vulnerable when deserializing QPY Files and may overflow the available stack space.
Qiskit could allow a local attacker to cause a denial of service due to a stack overflow during deserialization of QPY payloads. A malicious QPY payload can trigger a segmentati…
Published: 2026-09-03 · CVSS: 6.2 · CVSS 3.1
Qiskit could allow a local attacker to cause a denial of service due to a stack overflow during deserialization of QPY payloads. A malicious QPY payload can trigger a segmentation fault, causing the application to crash when deserializing untrusted input.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7