CVE-2026-4870 describes a denial of service vulnerability in IBM Qiskit SDK versions 0.43.0 through 2.5.0. The issue arises from uncontrolled recursion in the parser, which can be triggered by an attacker to cause a segmentation fault, crashing the application. The vulnerability is classified under CWE-674 (Improper Control of a Resource Through a Logic Time Bomb or a Race Condition). The CVSS 3.1 base score is 7.5, indicating high severity, with network attack vector, low attack complexity, no privileges or user interaction required, and impact limited to availability (denial of service). No official patch or remediation level has been published yet, and no known exploits are reported in the wild.

Successful exploitation results in a segmentation fault that causes denial of service by crashing the IBM Qiskit SDK process. There is no impact on confidentiality or integrity reported. The denial of service can disrupt operations relying on the SDK.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider limiting exposure of the vulnerable component to untrusted inputs or networks to reduce the risk of exploitation.