CVE-2025-1403
Published: 21 February 2025
Summary
CVE-2025-1403 is a high-severity Deserialization of Untrusted Data (CWE-502) vulnerability in Ibm Qiskit. Its CVSS base score is 8.6 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Application or System Exploitation (T1499.004); ranked at the 27.2th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Directly mitigates the vulnerability by identifying, reporting, and correcting the symengine deserialization flaw in affected Qiskit SDK versions through timely patching.
Validates QPY file inputs prior to deserialization to block malformed symengine serialization streams that trigger segmentation faults.
Implements safeguards against denial-of-service attacks, including application crashes induced by processing malicious QPY files.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
The CVE enables endpoint DoS via direct exploitation of a deserialization flaw in QPY file processing, causing a segfault/crash (T1499.004).
NVD Description
Qiskit SDK 0.45.0 through 1.2.4 could allow a remote attacker to cause a denial of service using a maliciously crafted QPY file containing a malformed symengine serialization stream which can cause a segfault within the symengine library.
Deeper analysisAI
CVE-2025-1403 affects Qiskit SDK versions 0.45.0 through 1.2.4, enabling a remote attacker to trigger a denial of service via a maliciously crafted QPY file. The file includes a malformed symengine serialization stream that causes a segmentation fault in the symengine library. Published on 2025-02-21, this vulnerability is rated 8.6 on the CVSS v3.1 scale (AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H) and maps to CWE-502 (Deserialization of Untrusted Data).
A remote attacker can exploit this vulnerability over the network with low attack complexity, requiring no privileges, authentication, or user interaction. By convincing a target to process the malicious QPY file, the attacker induces a crash in the affected Qiskit application, resulting in high availability impact due to the changed scope.
IBM provides details on this issue in their security advisory at https://www.ibm.com/support/pages/node/7183868.
Details
- CWE(s)