CVE-2025-1403: Malciously crafted QPY files can allows Remote Attackers to Cause Denial of Service in Qiskit

February 21, 2025

A maliciously crafted QPY file containing a malformed symengine serialization stream as part of the larger QPY serialization of a ParameterExpression object can cause a segfault within the symengine library, allowing an attacker to terminate the hosting process deserializing the QPY payload.

References

github.com/Qiskit/qiskit
github.com/Qiskit/qiskit/security/advisories/GHSA-fpmr-m242-xm7x
github.com/advisories/GHSA-fpmr-m242-xm7x
github.com/symengine/symengine/commit/eb3e292bf13b2dfdf0fa1c132944af8df2bc7d51
nvd.nist.gov/vuln/detail/CVE-2025-1403
www.ibm.com/support/pages/node/7183868

Code Behaviors & Features

Detect and mitigate CVE-2025-1403 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →