IBM Qiskit vulnerabilities

2 CVEs affecting IBM Qiskit, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2025-2000, published 2025-03-14.

More from IBM.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

• CVE-2025-2000, published 2025-03-14. Critical severity, CVSS 9.8. EPSS: 0.8% chance of exploitation in the next 30 days. A maliciously crafted QPY file can potential execute arbitrary-code embedded in the payload without privilege escalation when deserialising QPY formats < 13. A python process calling Qiskit 0.18.0…
• CVE-2025-1403, published 2025-02-21. High severity, CVSS 8.6. EPSS: 0.7% chance of exploitation in the next 30 days. Qiskit SDK 0.45.0 through 1.2.4 could allow a remote attacker to cause a denial of service using a maliciously crafted QPY file containing a malformed symengine serialization stream which can cause a…