CVE-2025-1403

HIGH

IBM Qiskit < 1.2.4 - Insecure Deserialization

Title source: rule

Description

Qiskit SDK 0.45.0 through 1.2.4 could allow a remote attacker to cause a denial of service using a maliciously crafted QPY file containing a malformed symengine serialization stream which can cause a segfault within the symengine library.

References (1)

[Vendor Advisory] https://www.ibm.com/support/pages/node/7183868

Scores

CVSS v3 8.6

EPSS 0.0037

EPSS Percentile 58.5%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H

Classification

CWE

CWE-502

Status published

Affected Products (3)

ibm/qiskit < 1.2.4

pypi/qiskit < 1.3.0PyPI

pypi/qiskit-terra PyPI

Timeline

Published Feb 21, 2025

Tracked Since Feb 18, 2026