p PatchFirst

CVE-2025-1403

CVE-2025-1403 · Qiskit SDK denial of service

This page contains facts from public vulnerability sources. Check the original advisory before updating.

Qiskit SDK 0.45.0 through 1.2.4 could allow a remote attacker to cause a denial of service using a maliciously crafted QPY file containing a malformed symengine serialization stream which can cause a segfault within the symengine library.

CVSS 8.6 · High · EPSS 0.7% · Fix available

Published
Updated

Stack: python

Affected products and versions

  • qiskit sdk

    Versions
    • ≥ 0.45.0, ≤ 1.2.4: Affected (semver)

    No fix published

  • qiskit PyPI

    Versions
    • 0.45.0
    • 0.45.1
    • 0.45.2
    • 0.45.3
    • 0.46.0
    • 0.46.1
    • 0.46.2
    • 0.46.3
    • 1.0.0
    • 1.0.0b1
    • 1.0.0rc1
    • 1.0.1
    • 1.0.2
    • 1.1.0
    • 1.1.0rc1
    • 1.1.1
    • 1.1.2
    • 1.2.0
    • 1.2.0rc1
    • 1.2.1
    • 1.2.2
    • 1.2.3
    • 1.2.4
    • 1.3.0b1
    • 1.3.0rc1
    • 1.3.0rc2
    Affected ranges
    • ECOSYSTEM: ≥ 0.45.0, < 1.3.0

    Update to 1.3.0

  • qiskit-terra PyPI

    Versions
    • 0.45.0
    • 0.45.1
    • 0.45.2
    • 0.45.3
    • 0.46.0
    • 0.46.1
    • 0.46.2
    • 0.46.3
    Affected ranges
    • ECOSYSTEM: ≥ 0.45.0, ≤ 0.46.3

    No fix published

Original sources

Check your server →