The advisory explicitly identifies qiskit.qpy.load() as the entry point for processing QPY files. The CWE-502 classification indicates insecure deserialization patterns. While exact implementation details aren't provided, the function's role in decoding serialized quantum programs and the documented attack vector (malicious QPY payloads) strongly suggest it uses Python's pickle or similar unsafe deserialization mechanisms internally when handling older QPY formats. The high confidence comes from multiple sources (IBM advisory, GHSA, NVD) directly linking this function to the vulnerability.