critical9.8
CVE-2025-2000
Qiskit allows arbitrary code execution decoding QPY format versions < 13
Impact
### Impact A maliciously crafted QPY file can potentially execute arbitrary-code embedded in the payload without privilege escalation when deserializing QPY formats < 13. A python process calling Qiskit's `qiskit.qpy.load()` function could potentially execute any arbitrary Python code embedded in the correct place in the binary file as part of a specially constructed payload. ### Patches Fixed in Qiskit 1.4.2 and in Qiskit 2.0.0rc2
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| pip | qiskit-terra | >= 0.18.0, <= 0.46.3 | none recorded |
| pip | qiskit | <= 1.4.1 | 1.4.2 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Ibm | Qiskit | from 0.18.0 before 1.4.2 |