CVE-2026-4870: Qiskit SDK is vulnerable to specific functions may recurse too deeply and overflow the available stack space, when encountering certain classical expressions.

Synopsis

This is an uncontrolled recursion vulnerability in IBM Qiskit SDK versions 0.43.0 through 2.5.0. The flaw is reachable over the network without any authentication and is triggered by supplying crafted classical expressions to the SDK's parser, which recurses too deeply and overflows the available stack space, causing a segmentation fault. Successful exploitation crashes the affected service, resulting in a denial of service. No fix version has been published yet; HarborGuard tracks the advisory and will surface a patched rebuild the moment IBM releases one.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The vulnerable parser is exposed over the network, meaning an attacker must be able to send crafted input to the service across the internet or an internal network.

• AuthenticationNot required

  No credentials or account are needed; the attacker can submit malicious classical expressions as an unauthenticated caller.

• Victim interactionNot required

  No user action is required; the attacker triggers the fault directly by sending specially crafted input to the parser.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and requires no special conditions, race timing, or environmental prerequisites.

Blast Radius

• Crashes the Qiskit SDK parser process via a segmentation fault, taking down any service or pipeline stage that depends on it.
• Makes quantum circuit compilation and execution unavailable for the duration of the outage, disrupting workloads that rely on the SDK.
• Repeated triggering allows an attacker to keep the service continuously unavailable with low effort due to the low attack complexity.