qiskit-terra

Version	Released
`0.46.3` patch 2 CVEs	Sep 26, 2024
`0.46.2` patch 2 CVEs	Jun 20, 2024
`0.46.1` patch 2 CVEs	Mar 08, 2024
`0.46.0` minor 2 CVEs	Feb 01, 2024
`0.45.3` patch 2 CVEs	Feb 01, 2024
`0.45.2` patch 2 CVEs	Jan 18, 2024
`0.45.1` patch 2 CVEs	Nov 29, 2023
`0.45.0` minor 2 CVEs	Nov 03, 2023
`0.25.3` patch 1 CVE	Oct 25, 2023
`0.45.0rc1` pre 1 CVE	Oct 19, 2023
`0.25.2.1` patch 1 CVE	Oct 04, 2023
`0.25.2` patch 1 CVE	Oct 03, 2023
`0.25.1` patch 1 CVE	Aug 17, 2023
`0.25.0` minor 1 CVE	Jul 27, 2023
`0.25.0rc1` pre 1 CVE	Jul 21, 2023
`0.24.2` patch 1 CVE	Jul 19, 2023
`0.24.1` patch 1 CVE	Jun 02, 2023
`0.24.0` minor 1 CVE	May 04, 2023
`0.24.0rc1` pre 1 CVE	Apr 20, 2023
`0.23.3` patch 1 CVE	Mar 21, 2023
`0.23.2` patch 1 CVE	Feb 23, 2023
`0.23.1` patch 1 CVE	Jan 31, 2023
`0.23.0` minor 1 CVE	Jan 26, 2023
`0.23.0rc1` pre 1 CVE	Jan 19, 2023
`0.22.4` patch 1 CVE	Jan 17, 2023
`0.22.3` patch 1 CVE	Nov 23, 2022
`0.22.2` patch 1 CVE	Nov 04, 2022
`0.22.1` patch 1 CVE	Nov 02, 2022
`0.22.0` minor 1 CVE	Oct 13, 2022
`0.22.0rc1` pre 1 CVE	Oct 07, 2022
`0.21.2` patch 1 CVE	Aug 23, 2022
`0.21.1` patch 1 CVE	Jul 28, 2022
`0.21.0` minor 1 CVE	Jun 30, 2022
`0.21.0rc1` pre 1 CVE	Jun 23, 2022
`0.20.2` patch 1 CVE	May 18, 2022
`0.20.1` patch 1 CVE	Apr 21, 2022
`0.20.0` minor 1 CVE	Mar 31, 2022
`0.19.2` patch 1 CVE	Feb 02, 2022
`0.19.1` patch 1 CVE	Dec 10, 2021
`0.19.0` minor 1 CVE	Dec 06, 2021
`0.18.3` patch 1 CVE	Sep 29, 2021
`0.18.2` patch 1 CVE	Sep 09, 2021
`0.18.1` patch 1 CVE	Aug 02, 2021
`0.18.0` minor 1 CVE	Jul 12, 2021
`0.17.4` patch	May 18, 2021
`0.17.3` patch	May 10, 2021
`0.17.2` patch	May 05, 2021
`0.17.1` patch	Apr 15, 2021
`0.17.0` minor	Apr 01, 2021
`0.16.4` patch	Feb 08, 2021

0.46.3 patch

2 CVEs

CVE-2025-1403 PYSEC-2026-1859 GHSA-fpmr-m242-xm7x PYSEC-2026-3045 Jul 07, 2026

Malciously crafted QPY files can allows Remote Attackers to Cause Denial of Service in Qiskit

8.6 / 10

High

Network Low None None Changed None None High

Impact

A maliciously crafted QPY file containing a malformed symengine serialization stream as part of the larger QPY serialization of a ParameterExpression object can cause a segfault within the symengine library, allowing an attacker to terminate the hosting process deserializing the QPY payload.

Patches

This issue is addressed in 1.3.0 when using QPY format version 13. QPY format versions 10, 11, and 12 are all still inherently vulnerable if they are using symengine symbolic encoding and symengine <= 0.13.0 is installed in the deserializing environment (as of publishing there is no newer compatible release of symengine available). Using QPY 13 is strongly recommended for this reason.

The symengine 0.14.0 release has addressed the segfault issue, but it is backward incompatible and will not work with any Qiskit release; it also prevents loading a payload generated with any other version of symengine. Using QPY 13 is strongly recommended for this reason.

It is also strongly suggested to patch the locally installed version of symengine in the deserializing environment to prevent the specific segfault. The commit [1] can be applied on top of symengine 0.13.0 and used to build a patched python library that will not segfault in the presence of a malformed payload and instead raise a RuntimeError which will address the vulnerability.

Workarounds

As QPY is backwards compatible qiskit.qpy.load() function will always attempt to deserialize the symengine-serialized payloads in QPY format versions 10, 11, and 12. These are any payloads generated with the use_symengine argument on qiskit.qpy.dump() set to True (which is the default value starting in Qiskit 1.0.0. The only option is to disallow parsing if those QPY formats are being read and the use_symengine flag was set in the file's header. You can detect whether a payload is potentially vulnerable by using the following function built using the Python standard library:

import struct
from collections import namedtuple


def check_qpy_payload(path: str) -> bool:
    """Function to check if a QPY payload is potentially vulnerable to a symengine vulnerability.

    Args:
        path: The path to the QPY file

    Returns:
        Whether the specified payload is potentially vulnerable. If ``True`` the conditions for
        being vulnerable exist, however the payload may not be vulnerable it can't be detected
        until trying to deserialize.
    """
    with open(path, "rb") as file_obj:
        version = struct.unpack("!6sB", file_obj.read(7))[1]
        if version < 10 or version >= 13:
            return False
        file_obj.seek(0)
        header_tuple = namedtuple(
            "FILE_HEADER",
            [
                "preface",
                "qpy_version",
                "major_version",
                "minor_version",
                "patch_version",
                "num_programs",
                "symbolic_encoding",
            ],
        )
        header_pack_str = "!6sBBBBQc"
        header_read_size = struct.calcsize(header_pack_str)
        data = struct.unpack(header_pack_str, file_obj.read(header_read_size))
        header = header_tuple(*data)
        return header.symbolic_encoding == b"e"

Note, this function does not tell you whether the payload is malicious and will cause the segfault, just that conditions for it to be potentially malicious exist. It's not possible to know ahead of time whether symengine will segfault until the data is passed to that library.

References

[1] https://github.com/symengine/symengine/commit/eb3e292bf13b2dfdf0fa1c132944af8df2bc7d51

Affected versions


          0.45.0


          0.45.1


          0.45.2


          0.45.3


          0.46.0


          0.46.1


          0.46.2


          0.46.3

References

Updated Jul 13, 2026 · Source: OSV.dev

CVE-2025-2000 PYSEC-2026-511 GHSA-6m2c-76ff-6vrf PYSEC-2026-510 Jun 29, 2026

Qiskit allows arbitrary code execution decoding QPY format versions < 13

9.8 / 10

Critical

Network Low None None Unchanged High High High

Impact

A maliciously crafted QPY file can potentially execute arbitrary-code embedded in the payload without privilege escalation when deserializing QPY formats < 13. A python process calling Qiskit's qiskit.qpy.load() function could potentially execute any arbitrary Python code embedded in the correct place in the binary file as part of a specially constructed payload.

Patches

Fixed in Qiskit 1.4.2 and in Qiskit 2.0.0rc2

Affected versions


          0.18.0


          0.18.1


          0.18.2


          0.18.3


          0.19.0


          0.19.1


          0.19.2


          0.20.0


          0.20.1


          0.20.2


          0.21.0


          0.21.0rc1

+ 32 more


            0.21.1


            0.21.2


            0.22.0


            0.22.0rc1


            0.22.1


            0.22.2


            0.22.3


            0.22.4


            0.23.0


            0.23.0rc1


            0.23.1


            0.23.2


            0.23.3


            0.24.0


            0.24.0rc1


            0.24.1


            0.24.2


            0.25.0


            0.25.0rc1


            0.25.1


            0.25.2


            0.25.2.1


            0.25.3


            0.45.0


            0.45.0rc1


            0.45.1


            0.45.2


            0.45.3


            0.46.0


            0.46.1


            0.46.2


            0.46.3

References

Updated Jul 01, 2026 · Source: OSV.dev

Sep 26, 2024

0.46.2 patch

2 CVEs

CVE-2025-1403 PYSEC-2026-1859 GHSA-fpmr-m242-xm7x PYSEC-2026-3045 Jul 07, 2026

Malciously crafted QPY files can allows Remote Attackers to Cause Denial of Service in Qiskit

8.6 / 10

High

Network Low None None Changed None None High

Impact

A maliciously crafted QPY file containing a malformed symengine serialization stream as part of the larger QPY serialization of a ParameterExpression object can cause a segfault within the symengine library, allowing an attacker to terminate the hosting process deserializing the QPY payload.

Patches

This issue is addressed in 1.3.0 when using QPY format version 13. QPY format versions 10, 11, and 12 are all still inherently vulnerable if they are using symengine symbolic encoding and symengine <= 0.13.0 is installed in the deserializing environment (as of publishing there is no newer compatible release of symengine available). Using QPY 13 is strongly recommended for this reason.

The symengine 0.14.0 release has addressed the segfault issue, but it is backward incompatible and will not work with any Qiskit release; it also prevents loading a payload generated with any other version of symengine. Using QPY 13 is strongly recommended for this reason.

It is also strongly suggested to patch the locally installed version of symengine in the deserializing environment to prevent the specific segfault. The commit [1] can be applied on top of symengine 0.13.0 and used to build a patched python library that will not segfault in the presence of a malformed payload and instead raise a RuntimeError which will address the vulnerability.

Workarounds

As QPY is backwards compatible qiskit.qpy.load() function will always attempt to deserialize the symengine-serialized payloads in QPY format versions 10, 11, and 12. These are any payloads generated with the use_symengine argument on qiskit.qpy.dump() set to True (which is the default value starting in Qiskit 1.0.0. The only option is to disallow parsing if those QPY formats are being read and the use_symengine flag was set in the file's header. You can detect whether a payload is potentially vulnerable by using the following function built using the Python standard library:

import struct
from collections import namedtuple


def check_qpy_payload(path: str) -> bool:
    """Function to check if a QPY payload is potentially vulnerable to a symengine vulnerability.

    Args:
        path: The path to the QPY file

    Returns:
        Whether the specified payload is potentially vulnerable. If ``True`` the conditions for
        being vulnerable exist, however the payload may not be vulnerable it can't be detected
        until trying to deserialize.
    """
    with open(path, "rb") as file_obj:
        version = struct.unpack("!6sB", file_obj.read(7))[1]
        if version < 10 or version >= 13:
            return False
        file_obj.seek(0)
        header_tuple = namedtuple(
            "FILE_HEADER",
            [
                "preface",
                "qpy_version",
                "major_version",
                "minor_version",
                "patch_version",
                "num_programs",
                "symbolic_encoding",
            ],
        )
        header_pack_str = "!6sBBBBQc"
        header_read_size = struct.calcsize(header_pack_str)
        data = struct.unpack(header_pack_str, file_obj.read(header_read_size))
        header = header_tuple(*data)
        return header.symbolic_encoding == b"e"

Note, this function does not tell you whether the payload is malicious and will cause the segfault, just that conditions for it to be potentially malicious exist. It's not possible to know ahead of time whether symengine will segfault until the data is passed to that library.

References

[1] https://github.com/symengine/symengine/commit/eb3e292bf13b2dfdf0fa1c132944af8df2bc7d51

Affected versions


          0.45.0


          0.45.1


          0.45.2


          0.45.3


          0.46.0


          0.46.1


          0.46.2


          0.46.3

References

Updated Jul 13, 2026 · Source: OSV.dev

CVE-2025-2000 PYSEC-2026-511 GHSA-6m2c-76ff-6vrf PYSEC-2026-510 Jun 29, 2026

Qiskit allows arbitrary code execution decoding QPY format versions < 13

9.8 / 10

Critical

Network Low None None Unchanged High High High

Impact

A maliciously crafted QPY file can potentially execute arbitrary-code embedded in the payload without privilege escalation when deserializing QPY formats < 13. A python process calling Qiskit's qiskit.qpy.load() function could potentially execute any arbitrary Python code embedded in the correct place in the binary file as part of a specially constructed payload.

Patches

Fixed in Qiskit 1.4.2 and in Qiskit 2.0.0rc2

Affected versions


          0.18.0


          0.18.1


          0.18.2


          0.18.3


          0.19.0


          0.19.1


          0.19.2


          0.20.0


          0.20.1


          0.20.2


          0.21.0


          0.21.0rc1

+ 32 more


            0.21.1


            0.21.2


            0.22.0


            0.22.0rc1


            0.22.1


            0.22.2


            0.22.3


            0.22.4


            0.23.0


            0.23.0rc1


            0.23.1


            0.23.2


            0.23.3


            0.24.0


            0.24.0rc1


            0.24.1


            0.24.2


            0.25.0


            0.25.0rc1


            0.25.1


            0.25.2


            0.25.2.1


            0.25.3


            0.45.0


            0.45.0rc1


            0.45.1


            0.45.2


            0.45.3


            0.46.0


            0.46.1


            0.46.2


            0.46.3

References

Updated Jul 01, 2026 · Source: OSV.dev

Jun 20, 2024

0.46.1 patch

2 CVEs

CVE-2025-1403 PYSEC-2026-1859 GHSA-fpmr-m242-xm7x PYSEC-2026-3045 Jul 07, 2026

Malciously crafted QPY files can allows Remote Attackers to Cause Denial of Service in Qiskit

8.6 / 10

High

Network Low None None Changed None None High

Impact

A maliciously crafted QPY file containing a malformed symengine serialization stream as part of the larger QPY serialization of a ParameterExpression object can cause a segfault within the symengine library, allowing an attacker to terminate the hosting process deserializing the QPY payload.

Patches

This issue is addressed in 1.3.0 when using QPY format version 13. QPY format versions 10, 11, and 12 are all still inherently vulnerable if they are using symengine symbolic encoding and symengine <= 0.13.0 is installed in the deserializing environment (as of publishing there is no newer compatible release of symengine available). Using QPY 13 is strongly recommended for this reason.

The symengine 0.14.0 release has addressed the segfault issue, but it is backward incompatible and will not work with any Qiskit release; it also prevents loading a payload generated with any other version of symengine. Using QPY 13 is strongly recommended for this reason.

It is also strongly suggested to patch the locally installed version of symengine in the deserializing environment to prevent the specific segfault. The commit [1] can be applied on top of symengine 0.13.0 and used to build a patched python library that will not segfault in the presence of a malformed payload and instead raise a RuntimeError which will address the vulnerability.

Workarounds

As QPY is backwards compatible qiskit.qpy.load() function will always attempt to deserialize the symengine-serialized payloads in QPY format versions 10, 11, and 12. These are any payloads generated with the use_symengine argument on qiskit.qpy.dump() set to True (which is the default value starting in Qiskit 1.0.0. The only option is to disallow parsing if those QPY formats are being read and the use_symengine flag was set in the file's header. You can detect whether a payload is potentially vulnerable by using the following function built using the Python standard library:

import struct
from collections import namedtuple


def check_qpy_payload(path: str) -> bool:
    """Function to check if a QPY payload is potentially vulnerable to a symengine vulnerability.

    Args:
        path: The path to the QPY file

    Returns:
        Whether the specified payload is potentially vulnerable. If ``True`` the conditions for
        being vulnerable exist, however the payload may not be vulnerable it can't be detected
        until trying to deserialize.
    """
    with open(path, "rb") as file_obj:
        version = struct.unpack("!6sB", file_obj.read(7))[1]
        if version < 10 or version >= 13:
            return False
        file_obj.seek(0)
        header_tuple = namedtuple(
            "FILE_HEADER",
            [
                "preface",
                "qpy_version",
                "major_version",
                "minor_version",
                "patch_version",
                "num_programs",
                "symbolic_encoding",
            ],
        )
        header_pack_str = "!6sBBBBQc"
        header_read_size = struct.calcsize(header_pack_str)
        data = struct.unpack(header_pack_str, file_obj.read(header_read_size))
        header = header_tuple(*data)
        return header.symbolic_encoding == b"e"

Note, this function does not tell you whether the payload is malicious and will cause the segfault, just that conditions for it to be potentially malicious exist. It's not possible to know ahead of time whether symengine will segfault until the data is passed to that library.

References

[1] https://github.com/symengine/symengine/commit/eb3e292bf13b2dfdf0fa1c132944af8df2bc7d51

Affected versions


          0.45.0


          0.45.1


          0.45.2


          0.45.3


          0.46.0


          0.46.1


          0.46.2


          0.46.3

References

Updated Jul 13, 2026 · Source: OSV.dev

CVE-2025-2000 PYSEC-2026-511 GHSA-6m2c-76ff-6vrf PYSEC-2026-510 Jun 29, 2026

Qiskit allows arbitrary code execution decoding QPY format versions < 13

9.8 / 10

Critical

Network Low None None Unchanged High High High

Impact

A maliciously crafted QPY file can potentially execute arbitrary-code embedded in the payload without privilege escalation when deserializing QPY formats < 13. A python process calling Qiskit's qiskit.qpy.load() function could potentially execute any arbitrary Python code embedded in the correct place in the binary file as part of a specially constructed payload.

Patches

Fixed in Qiskit 1.4.2 and in Qiskit 2.0.0rc2

Affected versions


          0.18.0


          0.18.1


          0.18.2


          0.18.3


          0.19.0


          0.19.1


          0.19.2


          0.20.0


          0.20.1


          0.20.2


          0.21.0


          0.21.0rc1

+ 32 more


            0.21.1


            0.21.2


            0.22.0


            0.22.0rc1


            0.22.1


            0.22.2


            0.22.3


            0.22.4


            0.23.0


            0.23.0rc1


            0.23.1


            0.23.2


            0.23.3


            0.24.0


            0.24.0rc1


            0.24.1


            0.24.2


            0.25.0


            0.25.0rc1


            0.25.1


            0.25.2


            0.25.2.1


            0.25.3


            0.45.0


            0.45.0rc1


            0.45.1


            0.45.2


            0.45.3


            0.46.0


            0.46.1


            0.46.2


            0.46.3

References

Updated Jul 01, 2026 · Source: OSV.dev

Mar 08, 2024

0.46.0 minor

2 CVEs

CVE-2025-1403 PYSEC-2026-1859 GHSA-fpmr-m242-xm7x PYSEC-2026-3045 Jul 07, 2026

Malciously crafted QPY files can allows Remote Attackers to Cause Denial of Service in Qiskit

8.6 / 10

High

Network Low None None Changed None None High

Impact

A maliciously crafted QPY file containing a malformed symengine serialization stream as part of the larger QPY serialization of a ParameterExpression object can cause a segfault within the symengine library, allowing an attacker to terminate the hosting process deserializing the QPY payload.

Patches

This issue is addressed in 1.3.0 when using QPY format version 13. QPY format versions 10, 11, and 12 are all still inherently vulnerable if they are using symengine symbolic encoding and symengine <= 0.13.0 is installed in the deserializing environment (as of publishing there is no newer compatible release of symengine available). Using QPY 13 is strongly recommended for this reason.

The symengine 0.14.0 release has addressed the segfault issue, but it is backward incompatible and will not work with any Qiskit release; it also prevents loading a payload generated with any other version of symengine. Using QPY 13 is strongly recommended for this reason.

It is also strongly suggested to patch the locally installed version of symengine in the deserializing environment to prevent the specific segfault. The commit [1] can be applied on top of symengine 0.13.0 and used to build a patched python library that will not segfault in the presence of a malformed payload and instead raise a RuntimeError which will address the vulnerability.

Workarounds

As QPY is backwards compatible qiskit.qpy.load() function will always attempt to deserialize the symengine-serialized payloads in QPY format versions 10, 11, and 12. These are any payloads generated with the use_symengine argument on qiskit.qpy.dump() set to True (which is the default value starting in Qiskit 1.0.0. The only option is to disallow parsing if those QPY formats are being read and the use_symengine flag was set in the file's header. You can detect whether a payload is potentially vulnerable by using the following function built using the Python standard library:

import struct
from collections import namedtuple


def check_qpy_payload(path: str) -> bool:
    """Function to check if a QPY payload is potentially vulnerable to a symengine vulnerability.

    Args:
        path: The path to the QPY file

    Returns:
        Whether the specified payload is potentially vulnerable. If ``True`` the conditions for
        being vulnerable exist, however the payload may not be vulnerable it can't be detected
        until trying to deserialize.
    """
    with open(path, "rb") as file_obj:
        version = struct.unpack("!6sB", file_obj.read(7))[1]
        if version < 10 or version >= 13:
            return False
        file_obj.seek(0)
        header_tuple = namedtuple(
            "FILE_HEADER",
            [
                "preface",
                "qpy_version",
                "major_version",
                "minor_version",
                "patch_version",
                "num_programs",
                "symbolic_encoding",
            ],
        )
        header_pack_str = "!6sBBBBQc"
        header_read_size = struct.calcsize(header_pack_str)
        data = struct.unpack(header_pack_str, file_obj.read(header_read_size))
        header = header_tuple(*data)
        return header.symbolic_encoding == b"e"

Note, this function does not tell you whether the payload is malicious and will cause the segfault, just that conditions for it to be potentially malicious exist. It's not possible to know ahead of time whether symengine will segfault until the data is passed to that library.

References

[1] https://github.com/symengine/symengine/commit/eb3e292bf13b2dfdf0fa1c132944af8df2bc7d51

Affected versions


          0.45.0


          0.45.1


          0.45.2


          0.45.3


          0.46.0


          0.46.1


          0.46.2


          0.46.3

References

Updated Jul 13, 2026 · Source: OSV.dev

CVE-2025-2000 PYSEC-2026-511 GHSA-6m2c-76ff-6vrf PYSEC-2026-510 Jun 29, 2026

Qiskit allows arbitrary code execution decoding QPY format versions < 13

9.8 / 10

Critical

Network Low None None Unchanged High High High

Impact

A maliciously crafted QPY file can potentially execute arbitrary-code embedded in the payload without privilege escalation when deserializing QPY formats < 13. A python process calling Qiskit's qiskit.qpy.load() function could potentially execute any arbitrary Python code embedded in the correct place in the binary file as part of a specially constructed payload.

Patches

Fixed in Qiskit 1.4.2 and in Qiskit 2.0.0rc2

Affected versions


          0.18.0


          0.18.1


          0.18.2


          0.18.3


          0.19.0


          0.19.1


          0.19.2


          0.20.0


          0.20.1


          0.20.2


          0.21.0


          0.21.0rc1

+ 32 more


            0.21.1


            0.21.2


            0.22.0


            0.22.0rc1


            0.22.1


            0.22.2


            0.22.3


            0.22.4


            0.23.0


            0.23.0rc1


            0.23.1


            0.23.2


            0.23.3


            0.24.0


            0.24.0rc1


            0.24.1


            0.24.2


            0.25.0


            0.25.0rc1


            0.25.1


            0.25.2


            0.25.2.1


            0.25.3


            0.45.0


            0.45.0rc1


            0.45.1


            0.45.2


            0.45.3


            0.46.0


            0.46.1


            0.46.2


            0.46.3

References

Updated Jul 01, 2026 · Source: OSV.dev

Feb 01, 2024

0.45.3 patch

2 CVEs

CVE-2025-1403 PYSEC-2026-1859 GHSA-fpmr-m242-xm7x PYSEC-2026-3045 Jul 07, 2026

Malciously crafted QPY files can allows Remote Attackers to Cause Denial of Service in Qiskit

8.6 / 10

High

Network Low None None Changed None None High

Impact

A maliciously crafted QPY file containing a malformed symengine serialization stream as part of the larger QPY serialization of a ParameterExpression object can cause a segfault within the symengine library, allowing an attacker to terminate the hosting process deserializing the QPY payload.

Patches

This issue is addressed in 1.3.0 when using QPY format version 13. QPY format versions 10, 11, and 12 are all still inherently vulnerable if they are using symengine symbolic encoding and symengine <= 0.13.0 is installed in the deserializing environment (as of publishing there is no newer compatible release of symengine available). Using QPY 13 is strongly recommended for this reason.

The symengine 0.14.0 release has addressed the segfault issue, but it is backward incompatible and will not work with any Qiskit release; it also prevents loading a payload generated with any other version of symengine. Using QPY 13 is strongly recommended for this reason.

It is also strongly suggested to patch the locally installed version of symengine in the deserializing environment to prevent the specific segfault. The commit [1] can be applied on top of symengine 0.13.0 and used to build a patched python library that will not segfault in the presence of a malformed payload and instead raise a RuntimeError which will address the vulnerability.

Workarounds

As QPY is backwards compatible qiskit.qpy.load() function will always attempt to deserialize the symengine-serialized payloads in QPY format versions 10, 11, and 12. These are any payloads generated with the use_symengine argument on qiskit.qpy.dump() set to True (which is the default value starting in Qiskit 1.0.0. The only option is to disallow parsing if those QPY formats are being read and the use_symengine flag was set in the file's header. You can detect whether a payload is potentially vulnerable by using the following function built using the Python standard library:

import struct
from collections import namedtuple


def check_qpy_payload(path: str) -> bool:
    """Function to check if a QPY payload is potentially vulnerable to a symengine vulnerability.

    Args:
        path: The path to the QPY file

    Returns:
        Whether the specified payload is potentially vulnerable. If ``True`` the conditions for
        being vulnerable exist, however the payload may not be vulnerable it can't be detected
        until trying to deserialize.
    """
    with open(path, "rb") as file_obj:
        version = struct.unpack("!6sB", file_obj.read(7))[1]
        if version < 10 or version >= 13:
            return False
        file_obj.seek(0)
        header_tuple = namedtuple(
            "FILE_HEADER",
            [
                "preface",
                "qpy_version",
                "major_version",
                "minor_version",
                "patch_version",
                "num_programs",
                "symbolic_encoding",
            ],
        )
        header_pack_str = "!6sBBBBQc"
        header_read_size = struct.calcsize(header_pack_str)
        data = struct.unpack(header_pack_str, file_obj.read(header_read_size))
        header = header_tuple(*data)
        return header.symbolic_encoding == b"e"

Note, this function does not tell you whether the payload is malicious and will cause the segfault, just that conditions for it to be potentially malicious exist. It's not possible to know ahead of time whether symengine will segfault until the data is passed to that library.

References

[1] https://github.com/symengine/symengine/commit/eb3e292bf13b2dfdf0fa1c132944af8df2bc7d51

Affected versions


          0.45.0


          0.45.1


          0.45.2


          0.45.3


          0.46.0


          0.46.1


          0.46.2


          0.46.3

References

Updated Jul 13, 2026 · Source: OSV.dev

CVE-2025-2000 PYSEC-2026-511 GHSA-6m2c-76ff-6vrf PYSEC-2026-510 Jun 29, 2026

Qiskit allows arbitrary code execution decoding QPY format versions < 13

9.8 / 10

Critical

Network Low None None Unchanged High High High

Impact

A maliciously crafted QPY file can potentially execute arbitrary-code embedded in the payload without privilege escalation when deserializing QPY formats < 13. A python process calling Qiskit's qiskit.qpy.load() function could potentially execute any arbitrary Python code embedded in the correct place in the binary file as part of a specially constructed payload.

Patches

Fixed in Qiskit 1.4.2 and in Qiskit 2.0.0rc2

Affected versions


          0.18.0


          0.18.1


          0.18.2


          0.18.3


          0.19.0


          0.19.1


          0.19.2


          0.20.0


          0.20.1


          0.20.2


          0.21.0


          0.21.0rc1

+ 32 more


            0.21.1


            0.21.2


            0.22.0


            0.22.0rc1


            0.22.1


            0.22.2


            0.22.3


            0.22.4


            0.23.0


            0.23.0rc1


            0.23.1


            0.23.2


            0.23.3


            0.24.0


            0.24.0rc1


            0.24.1


            0.24.2


            0.25.0


            0.25.0rc1


            0.25.1


            0.25.2


            0.25.2.1


            0.25.3


            0.45.0


            0.45.0rc1


            0.45.1


            0.45.2


            0.45.3


            0.46.0


            0.46.1


            0.46.2


            0.46.3

References

Updated Jul 01, 2026 · Source: OSV.dev

Feb 01, 2024

0.45.2 patch

2 CVEs

CVE-2025-1403 PYSEC-2026-1859 GHSA-fpmr-m242-xm7x PYSEC-2026-3045 Jul 07, 2026

Malciously crafted QPY files can allows Remote Attackers to Cause Denial of Service in Qiskit

8.6 / 10

High

Network Low None None Changed None None High

Impact

A maliciously crafted QPY file containing a malformed symengine serialization stream as part of the larger QPY serialization of a ParameterExpression object can cause a segfault within the symengine library, allowing an attacker to terminate the hosting process deserializing the QPY payload.

Patches

This issue is addressed in 1.3.0 when using QPY format version 13. QPY format versions 10, 11, and 12 are all still inherently vulnerable if they are using symengine symbolic encoding and symengine <= 0.13.0 is installed in the deserializing environment (as of publishing there is no newer compatible release of symengine available). Using QPY 13 is strongly recommended for this reason.

The symengine 0.14.0 release has addressed the segfault issue, but it is backward incompatible and will not work with any Qiskit release; it also prevents loading a payload generated with any other version of symengine. Using QPY 13 is strongly recommended for this reason.

It is also strongly suggested to patch the locally installed version of symengine in the deserializing environment to prevent the specific segfault. The commit [1] can be applied on top of symengine 0.13.0 and used to build a patched python library that will not segfault in the presence of a malformed payload and instead raise a RuntimeError which will address the vulnerability.

Workarounds

As QPY is backwards compatible qiskit.qpy.load() function will always attempt to deserialize the symengine-serialized payloads in QPY format versions 10, 11, and 12. These are any payloads generated with the use_symengine argument on qiskit.qpy.dump() set to True (which is the default value starting in Qiskit 1.0.0. The only option is to disallow parsing if those QPY formats are being read and the use_symengine flag was set in the file's header. You can detect whether a payload is potentially vulnerable by using the following function built using the Python standard library:

import struct
from collections import namedtuple


def check_qpy_payload(path: str) -> bool:
    """Function to check if a QPY payload is potentially vulnerable to a symengine vulnerability.

    Args:
        path: The path to the QPY file

    Returns:
        Whether the specified payload is potentially vulnerable. If ``True`` the conditions for
        being vulnerable exist, however the payload may not be vulnerable it can't be detected
        until trying to deserialize.
    """
    with open(path, "rb") as file_obj:
        version = struct.unpack("!6sB", file_obj.read(7))[1]
        if version < 10 or version >= 13:
            return False
        file_obj.seek(0)
        header_tuple = namedtuple(
            "FILE_HEADER",
            [
                "preface",
                "qpy_version",
                "major_version",
                "minor_version",
                "patch_version",
                "num_programs",
                "symbolic_encoding",
            ],
        )
        header_pack_str = "!6sBBBBQc"
        header_read_size = struct.calcsize(header_pack_str)
        data = struct.unpack(header_pack_str, file_obj.read(header_read_size))
        header = header_tuple(*data)
        return header.symbolic_encoding == b"e"

Note, this function does not tell you whether the payload is malicious and will cause the segfault, just that conditions for it to be potentially malicious exist. It's not possible to know ahead of time whether symengine will segfault until the data is passed to that library.

References

[1] https://github.com/symengine/symengine/commit/eb3e292bf13b2dfdf0fa1c132944af8df2bc7d51

Affected versions


          0.45.0


          0.45.1


          0.45.2


          0.45.3


          0.46.0


          0.46.1


          0.46.2


          0.46.3

References

Updated Jul 13, 2026 · Source: OSV.dev

CVE-2025-2000 PYSEC-2026-511 GHSA-6m2c-76ff-6vrf PYSEC-2026-510 Jun 29, 2026

Qiskit allows arbitrary code execution decoding QPY format versions < 13

9.8 / 10

Critical

Network Low None None Unchanged High High High

Impact

A maliciously crafted QPY file can potentially execute arbitrary-code embedded in the payload without privilege escalation when deserializing QPY formats < 13. A python process calling Qiskit's qiskit.qpy.load() function could potentially execute any arbitrary Python code embedded in the correct place in the binary file as part of a specially constructed payload.

Patches

Fixed in Qiskit 1.4.2 and in Qiskit 2.0.0rc2

Affected versions


          0.18.0


          0.18.1


          0.18.2


          0.18.3


          0.19.0


          0.19.1


          0.19.2


          0.20.0


          0.20.1


          0.20.2


          0.21.0


          0.21.0rc1

+ 32 more


            0.21.1


            0.21.2


            0.22.0


            0.22.0rc1


            0.22.1


            0.22.2


            0.22.3


            0.22.4


            0.23.0


            0.23.0rc1


            0.23.1


            0.23.2


            0.23.3


            0.24.0


            0.24.0rc1


            0.24.1


            0.24.2


            0.25.0


            0.25.0rc1


            0.25.1


            0.25.2


            0.25.2.1


            0.25.3


            0.45.0


            0.45.0rc1


            0.45.1


            0.45.2


            0.45.3


            0.46.0


            0.46.1


            0.46.2


            0.46.3

References

Updated Jul 01, 2026 · Source: OSV.dev

Jan 18, 2024

0.45.1 patch

2 CVEs

CVE-2025-1403 PYSEC-2026-1859 GHSA-fpmr-m242-xm7x PYSEC-2026-3045 Jul 07, 2026

Malciously crafted QPY files can allows Remote Attackers to Cause Denial of Service in Qiskit

8.6 / 10

High

Network Low None None Changed None None High

Impact

A maliciously crafted QPY file containing a malformed symengine serialization stream as part of the larger QPY serialization of a ParameterExpression object can cause a segfault within the symengine library, allowing an attacker to terminate the hosting process deserializing the QPY payload.

Patches

This issue is addressed in 1.3.0 when using QPY format version 13. QPY format versions 10, 11, and 12 are all still inherently vulnerable if they are using symengine symbolic encoding and symengine <= 0.13.0 is installed in the deserializing environment (as of publishing there is no newer compatible release of symengine available). Using QPY 13 is strongly recommended for this reason.

The symengine 0.14.0 release has addressed the segfault issue, but it is backward incompatible and will not work with any Qiskit release; it also prevents loading a payload generated with any other version of symengine. Using QPY 13 is strongly recommended for this reason.

It is also strongly suggested to patch the locally installed version of symengine in the deserializing environment to prevent the specific segfault. The commit [1] can be applied on top of symengine 0.13.0 and used to build a patched python library that will not segfault in the presence of a malformed payload and instead raise a RuntimeError which will address the vulnerability.

Workarounds

As QPY is backwards compatible qiskit.qpy.load() function will always attempt to deserialize the symengine-serialized payloads in QPY format versions 10, 11, and 12. These are any payloads generated with the use_symengine argument on qiskit.qpy.dump() set to True (which is the default value starting in Qiskit 1.0.0. The only option is to disallow parsing if those QPY formats are being read and the use_symengine flag was set in the file's header. You can detect whether a payload is potentially vulnerable by using the following function built using the Python standard library:

import struct
from collections import namedtuple


def check_qpy_payload(path: str) -> bool:
    """Function to check if a QPY payload is potentially vulnerable to a symengine vulnerability.

    Args:
        path: The path to the QPY file

    Returns:
        Whether the specified payload is potentially vulnerable. If ``True`` the conditions for
        being vulnerable exist, however the payload may not be vulnerable it can't be detected
        until trying to deserialize.
    """
    with open(path, "rb") as file_obj:
        version = struct.unpack("!6sB", file_obj.read(7))[1]
        if version < 10 or version >= 13:
            return False
        file_obj.seek(0)
        header_tuple = namedtuple(
            "FILE_HEADER",
            [
                "preface",
                "qpy_version",
                "major_version",
                "minor_version",
                "patch_version",
                "num_programs",
                "symbolic_encoding",
            ],
        )
        header_pack_str = "!6sBBBBQc"
        header_read_size = struct.calcsize(header_pack_str)
        data = struct.unpack(header_pack_str, file_obj.read(header_read_size))
        header = header_tuple(*data)
        return header.symbolic_encoding == b"e"

Note, this function does not tell you whether the payload is malicious and will cause the segfault, just that conditions for it to be potentially malicious exist. It's not possible to know ahead of time whether symengine will segfault until the data is passed to that library.

References

[1] https://github.com/symengine/symengine/commit/eb3e292bf13b2dfdf0fa1c132944af8df2bc7d51

Affected versions


          0.45.0


          0.45.1


          0.45.2


          0.45.3


          0.46.0


          0.46.1


          0.46.2


          0.46.3

References

Updated Jul 13, 2026 · Source: OSV.dev

CVE-2025-2000 PYSEC-2026-511 GHSA-6m2c-76ff-6vrf PYSEC-2026-510 Jun 29, 2026

Qiskit allows arbitrary code execution decoding QPY format versions < 13

9.8 / 10

Critical

Network Low None None Unchanged High High High

Impact

A maliciously crafted QPY file can potentially execute arbitrary-code embedded in the payload without privilege escalation when deserializing QPY formats < 13. A python process calling Qiskit's qiskit.qpy.load() function could potentially execute any arbitrary Python code embedded in the correct place in the binary file as part of a specially constructed payload.

Patches

Fixed in Qiskit 1.4.2 and in Qiskit 2.0.0rc2

Affected versions


          0.18.0


          0.18.1


          0.18.2


          0.18.3


          0.19.0


          0.19.1


          0.19.2


          0.20.0


          0.20.1


          0.20.2


          0.21.0


          0.21.0rc1

+ 32 more


            0.21.1


            0.21.2


            0.22.0


            0.22.0rc1


            0.22.1


            0.22.2


            0.22.3


            0.22.4


            0.23.0


            0.23.0rc1


            0.23.1


            0.23.2


            0.23.3


            0.24.0


            0.24.0rc1


            0.24.1


            0.24.2


            0.25.0


            0.25.0rc1


            0.25.1


            0.25.2


            0.25.2.1


            0.25.3


            0.45.0


            0.45.0rc1


            0.45.1


            0.45.2


            0.45.3


            0.46.0


            0.46.1


            0.46.2


            0.46.3

References

Updated Jul 01, 2026 · Source: OSV.dev

Nov 29, 2023

0.45.0 minor

2 CVEs

CVE-2025-1403 PYSEC-2026-1859 GHSA-fpmr-m242-xm7x PYSEC-2026-3045 Jul 07, 2026

Malciously crafted QPY files can allows Remote Attackers to Cause Denial of Service in Qiskit

8.6 / 10

High

Network Low None None Changed None None High

Impact

A maliciously crafted QPY file containing a malformed symengine serialization stream as part of the larger QPY serialization of a ParameterExpression object can cause a segfault within the symengine library, allowing an attacker to terminate the hosting process deserializing the QPY payload.

Patches

This issue is addressed in 1.3.0 when using QPY format version 13. QPY format versions 10, 11, and 12 are all still inherently vulnerable if they are using symengine symbolic encoding and symengine <= 0.13.0 is installed in the deserializing environment (as of publishing there is no newer compatible release of symengine available). Using QPY 13 is strongly recommended for this reason.

The symengine 0.14.0 release has addressed the segfault issue, but it is backward incompatible and will not work with any Qiskit release; it also prevents loading a payload generated with any other version of symengine. Using QPY 13 is strongly recommended for this reason.

It is also strongly suggested to patch the locally installed version of symengine in the deserializing environment to prevent the specific segfault. The commit [1] can be applied on top of symengine 0.13.0 and used to build a patched python library that will not segfault in the presence of a malformed payload and instead raise a RuntimeError which will address the vulnerability.

Workarounds

As QPY is backwards compatible qiskit.qpy.load() function will always attempt to deserialize the symengine-serialized payloads in QPY format versions 10, 11, and 12. These are any payloads generated with the use_symengine argument on qiskit.qpy.dump() set to True (which is the default value starting in Qiskit 1.0.0. The only option is to disallow parsing if those QPY formats are being read and the use_symengine flag was set in the file's header. You can detect whether a payload is potentially vulnerable by using the following function built using the Python standard library:

import struct
from collections import namedtuple


def check_qpy_payload(path: str) -> bool:
    """Function to check if a QPY payload is potentially vulnerable to a symengine vulnerability.

    Args:
        path: The path to the QPY file

    Returns:
        Whether the specified payload is potentially vulnerable. If ``True`` the conditions for
        being vulnerable exist, however the payload may not be vulnerable it can't be detected
        until trying to deserialize.
    """
    with open(path, "rb") as file_obj:
        version = struct.unpack("!6sB", file_obj.read(7))[1]
        if version < 10 or version >= 13:
            return False
        file_obj.seek(0)
        header_tuple = namedtuple(
            "FILE_HEADER",
            [
                "preface",
                "qpy_version",
                "major_version",
                "minor_version",
                "patch_version",
                "num_programs",
                "symbolic_encoding",
            ],
        )
        header_pack_str = "!6sBBBBQc"
        header_read_size = struct.calcsize(header_pack_str)
        data = struct.unpack(header_pack_str, file_obj.read(header_read_size))
        header = header_tuple(*data)
        return header.symbolic_encoding == b"e"

Note, this function does not tell you whether the payload is malicious and will cause the segfault, just that conditions for it to be potentially malicious exist. It's not possible to know ahead of time whether symengine will segfault until the data is passed to that library.

References

[1] https://github.com/symengine/symengine/commit/eb3e292bf13b2dfdf0fa1c132944af8df2bc7d51

Affected versions


          0.45.0


          0.45.1


          0.45.2


          0.45.3


          0.46.0


          0.46.1


          0.46.2


          0.46.3

References

Updated Jul 13, 2026 · Source: OSV.dev

CVE-2025-2000 PYSEC-2026-511 GHSA-6m2c-76ff-6vrf PYSEC-2026-510 Jun 29, 2026

Qiskit allows arbitrary code execution decoding QPY format versions < 13

9.8 / 10

Critical

Network Low None None Unchanged High High High

Impact

A maliciously crafted QPY file can potentially execute arbitrary-code embedded in the payload without privilege escalation when deserializing QPY formats < 13. A python process calling Qiskit's qiskit.qpy.load() function could potentially execute any arbitrary Python code embedded in the correct place in the binary file as part of a specially constructed payload.

Patches

Fixed in Qiskit 1.4.2 and in Qiskit 2.0.0rc2

Affected versions


          0.18.0


          0.18.1


          0.18.2


          0.18.3


          0.19.0


          0.19.1


          0.19.2


          0.20.0


          0.20.1


          0.20.2


          0.21.0


          0.21.0rc1

+ 32 more


            0.21.1


            0.21.2


            0.22.0


            0.22.0rc1


            0.22.1


            0.22.2


            0.22.3


            0.22.4


            0.23.0


            0.23.0rc1


            0.23.1


            0.23.2


            0.23.3


            0.24.0


            0.24.0rc1


            0.24.1


            0.24.2


            0.25.0


            0.25.0rc1


            0.25.1


            0.25.2


            0.25.2.1


            0.25.3


            0.45.0


            0.45.0rc1


            0.45.1


            0.45.2


            0.45.3


            0.46.0


            0.46.1


            0.46.2


            0.46.3

References

Updated Jul 01, 2026 · Source: OSV.dev

Nov 03, 2023

0.25.3 patch

1 CVE

Oct 25, 2023

0.45.0rc1 pre

1 CVE

Oct 19, 2023

0.25.2.1 patch

1 CVE

Oct 04, 2023

0.25.2 patch

1 CVE

Oct 03, 2023

0.25.1 patch

1 CVE

Aug 17, 2023

0.25.0 minor

1 CVE

Jul 27, 2023

0.25.0rc1 pre

1 CVE

Jul 21, 2023

0.24.2 patch

1 CVE

Jul 19, 2023

0.24.1 patch

1 CVE

Jun 02, 2023

0.24.0 minor

1 CVE

May 04, 2023

0.24.0rc1 pre

1 CVE

Apr 20, 2023

0.23.3 patch

1 CVE

Mar 21, 2023

0.23.2 patch

1 CVE

Feb 23, 2023

0.23.1 patch

1 CVE

Jan 31, 2023

0.23.0 minor

1 CVE

Jan 26, 2023

0.23.0rc1 pre

1 CVE

Jan 19, 2023

0.22.4 patch

1 CVE

Jan 17, 2023

0.22.3 patch

1 CVE

Nov 23, 2022

0.22.2 patch

1 CVE

Nov 04, 2022

0.22.1 patch

1 CVE

Nov 02, 2022

0.22.0 minor

1 CVE

Oct 13, 2022

0.22.0rc1 pre

1 CVE

Oct 07, 2022

0.21.2 patch

1 CVE

Aug 23, 2022

0.21.1 patch

1 CVE

Jul 28, 2022

0.21.0 minor

1 CVE

Jun 30, 2022

0.21.0rc1 pre

1 CVE

Jun 23, 2022

0.20.2 patch

1 CVE

May 18, 2022

0.20.1 patch

1 CVE

Apr 21, 2022

0.20.0 minor

1 CVE

Mar 31, 2022

0.19.2 patch

1 CVE

Feb 02, 2022

0.19.1 patch

1 CVE

Dec 10, 2021

0.19.0 minor

1 CVE

Dec 06, 2021

0.18.3 patch

1 CVE

Sep 29, 2021

0.18.2 patch

1 CVE

Sep 09, 2021

0.18.1 patch

1 CVE

Aug 02, 2021

0.18.0 minor

1 CVE

Jul 12, 2021

0.17.4 patch

May 18, 2021

0.17.3 patch

May 10, 2021

0.17.2 patch

May 05, 2021

0.17.1 patch

Apr 15, 2021

0.17.0 minor

Apr 01, 2021

0.16.4 patch

Feb 08, 2021

Activity

Details