5.5
Medium
CVE-2026-12480 Keras versions up to and including 3.13.2 are vulnerable to an arbitrary HDF5 file read due to an incomplete fix for…
Description
Keras versions up to and including 3.13.2 are vulnerable to an arbitrary HDF5 file read due to an incomplete fix for CVE-2026-1669. The vulnerability resides in the `H5IOStore._verify_dataset()` and `file_editor.py` methods, which fail to check the `dataset.is_virtual` property of HDF5 datasets. This allows an attacker to craft a malicious `.keras` model archive or `.h5` weights file containing a Virtual Dataset (VDS) that references external HDF5 files on the victim's filesystem. When the victim loads the model using `keras.models.load_model()` or `keras.saving.load_model()`, the external file is transparently read, leading to potential information disclosure. Fixed in versions 3.12.2 and 3.14.1.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| keras-team/keras | Versions not published |
Other CVEs of keras-team/keras
The 10 CVEs of keras-team/keras →
CVE-2026-12570
A vulnerability in keras-team/keras…
5.5
Medium
CVE-2026-9335
A vulnerability in keras-team/keras…
6.5
Medium
CVE-2026-12484
A vulnerability in keras-team/keras version 3.15.0 allows unsafe deserialization of attacker-controlled PyTorch pickle…
7.8
High
CVE-2026-12482
A vulnerability in keras-team/keras version 3.12.0 allows an attacker to craft a malicious tar archive that bypasses the…
3.1
Low