CVE-2026-19795

Name of the Vulnerable Software and Affected Versions IBM Qiskit SDK versions 2.1.0 through 2.5.1

Description Improper handling of a specially crafted object during deserialization allows a local attacker to cause a denial of service. A malicious QPY payload can trigger a segmentation fault, which is a specific error that occurs when a program attempts to access a memory location it is not allowed to access, resulting in an application crash when processing untrusted input.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.