CVE-2025-2000: IBM Qiskit RCE Vulnerability

CVE-2025-2000 Overview

CVE-2025-2000 is a critical insecure deserialization vulnerability affecting IBM Qiskit, the open-source quantum computing SDK. A maliciously crafted QPY file can potentially execute arbitrary code embedded in the payload without privilege escalation when deserializing QPY formats prior to version 13. Any Python process calling Qiskit versions 0.18.0 through 1.4.1's qiskit.qpy.load() function could potentially execute arbitrary Python code embedded in a specially constructed binary file payload.

Critical Impact

This vulnerability allows remote attackers to achieve arbitrary code execution on systems processing untrusted QPY files, potentially leading to complete system compromise without requiring any user privileges.

Affected Products

• IBM Qiskit versions 0.18.0 through 1.4.1
• QPY format versions prior to 13
• Systems processing untrusted QPY files via qiskit.qpy.load()

Discovery Timeline

• 2025-03-14 - CVE-2025-2000 published to NVD
• 2025-08-18 - Last updated in NVD database

Technical Details for CVE-2025-2000

Vulnerability Analysis

This vulnerability stems from insecure deserialization (CWE-502) in the QPY file format handling within IBM Qiskit. The QPY format is a binary serialization format used for storing and sharing quantum circuits. When deserializing QPY files using the qiskit.qpy.load() function, the library fails to properly validate or sanitize the contents of the binary payload before execution.

The vulnerability is exploitable over the network, requires no authentication or special privileges, and demands no user interaction. An attacker can craft a malicious QPY file containing embedded Python code that will be executed during the deserialization process. This makes it particularly dangerous in environments where QPY files are shared between systems or downloaded from untrusted sources.

Root Cause

The root cause is improper handling of serialized data during the QPY deserialization process. QPY format versions prior to 13 lack adequate security controls to prevent the inclusion and execution of arbitrary code within the serialized payload. The qiskit.qpy.load() function processes the binary file contents without sufficient validation, allowing embedded malicious code to be executed as part of the deserialization workflow.

Attack Vector

The attack vector is network-based, where an attacker creates a maliciously crafted QPY file and delivers it to a target system. The attack succeeds when a victim's Python process loads the malicious QPY file using the vulnerable qiskit.qpy.load() function. Common attack scenarios include:

• Sharing malicious QPY files through quantum computing collaboration platforms
• Compromising shared repositories containing quantum circuit files
• Delivering malicious files through phishing or social engineering
• Man-in-the-middle attacks intercepting legitimate QPY file transfers

The vulnerability exists in the deserialization logic where the binary file parser processes embedded code segments. When a vulnerable Qiskit version encounters a specially crafted QPY file, the malicious payload is deserialized and executed within the context of the running Python process, granting the attacker the same privileges as the application.

Detection Methods for CVE-2025-2000

Indicators of Compromise

• Unexpected process spawning from Python applications using Qiskit
• Anomalous network connections originating from Qiskit-dependent processes
• Suspicious file system activity following QPY file processing
• Unusual memory patterns or code execution in Python interpreter processes

Detection Strategies

• Monitor for suspicious calls to qiskit.qpy.load() with files from untrusted sources
• Implement file integrity monitoring for QPY files in shared directories
• Deploy application-level logging to track QPY file processing activities
• Use behavioral analysis to detect anomalous execution patterns following file deserialization

Monitoring Recommendations

• Enable verbose logging for applications that process QPY files
• Monitor Python process execution for unexpected child processes or network activity
• Implement alerting for QPY file uploads from external or untrusted sources
• Track Qiskit library versions across development and production environments

How to Mitigate CVE-2025-2000

Immediate Actions Required

• Upgrade IBM Qiskit to version 1.4.2 or later immediately
• Audit all systems for vulnerable Qiskit versions (0.18.0 through 1.4.1)
• Restrict QPY file processing to trusted sources only
• Implement input validation for all QPY files before processing

Patch Information

IBM has released a security update addressing this vulnerability. Organizations should upgrade to Qiskit version 1.4.2 or later, which includes fixes for the insecure deserialization issue in QPY format handling. Detailed patch information and upgrade instructions are available in the IBM Support Page.

Workarounds

• Avoid processing QPY files from untrusted or unverified sources until patched
• Implement application sandboxing for processes that handle QPY file deserialization
• Use QPY format version 13 or later which includes improved security controls
• Deploy network segmentation to isolate systems processing quantum computing workloads

# Upgrade Qiskit to patched version
pip install --upgrade qiskit>=1.4.2

# Verify installed version
pip show qiskit | grep Version

# Check for vulnerable Qiskit installations across environments
pip list | grep -i qiskit