Cloud Vulnerability DB
An open project to list all known cloud vulnerabilities and Cloud Service Provider security issues
Vulnerability DatabaseCVE-2025-2000
CVE-2025-2000:
Python vulnerability analysis and mitigation
Overview
A critical vulnerability (CVE-2025-2000) has been identified in the Qiskit Software Development Kit (SDK) versions 0.18.0 through 1.4.1. The vulnerability was discovered and disclosed on March 14, 2025, affecting the QPY deserialization functionality in Qiskit SDK. The issue allows maliciously crafted QPY files to execute arbitrary code embedded in the payload without privilege escalation when deserializing QPY formats less than version 13 (NVD, IBM Advisory).
Technical details
The vulnerability is classified with a CVSS v3.1 base score of 9.8 (CRITICAL) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. The issue specifically affects the qiskit.qpy.load() function, which can execute arbitrary Python code embedded in the correct place within a specially constructed binary file payload. The vulnerability is categorized as CWE-502: Deserialization of Untrusted Data (NVD, Security Online).
Impact
The vulnerability poses significant risks as it allows attackers to execute arbitrary code through specially crafted QPY files. Given Qiskit's widespread use in quantum computing applications for tasks involving quantum circuits and quantum operators, the impact is particularly concerning for the quantum computing community. The high CVSS score indicates potential for complete compromise of system confidentiality, integrity, and availability (Security Online).
Mitigation and workarounds
IBM has released patches to address this vulnerability. Users are strongly advised to upgrade to either Qiskit version 1.4.2 or Qiskit 2.0.0. These updated versions include critical patches that prevent the exploitation of this vulnerability. No alternative workarounds are available (ASEC, IBM Advisory).
Additional resources
Source: This report was generated using AI
Free Vulnerability Assessment
Benchmark your Cloud Security Posture
Evaluate your cloud security practices across 9 security domains to benchmark your risk level and identify gaps in your defenses.
Get a personalized demo
Ready to see Wiz in action?
“Best User Experience I have ever seen, provides full visibility to cloud workloads.”
David EstlickCISO
“Wiz provides a single pane of glass to see what is going on in our cloud environments.”
Adam FletcherChief Security Officer
“We know that if Wiz identifies something as critical, it actually is.”
Greg PoniatowskiHead of Threat and Vulnerability Management