CVE-2025-2000
CVSS 3.1 Score 9.8 of 10 (high)
Details
Published Mar 14, 2025
CWE ID 502
Summary
CVE-2025-2000 is a vulnerability affecting QPY files used by Qiskit versions 0.18.0 through 1.4.1. Maliciously crafted QPY files can execute arbitrary code without privilege escalation during the deserialization process of QPY formats below version 13. This issue enables attackers to embed Python code in a binary file, which can then be executed by a Python process calling `qiskit.qpy.load()`.
Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.
Affected Products
- QISKit SDK
Affected Vendors
- IBM Corporation