What is the CVSS score of CVE-2026-12480?

CVE-2026-12480 has a CVSS 3.0 base score of 5.5 (Medium). CVSS vector: CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.1%.

Is there a patch available for CVE-2026-12480?

Yes, a patch is available for CVE-2026-12480. Update the affected software to the latest version immediately.

Keras CVE-2026-12480

EUVD-2026-41090 MEDIUM

External Control of File Name or Path (CWE-73)

2026-07-01 security@huntr.dev

GHSA-26c4-7vv6-867j

Information Disclosure Red Hat

5.5

CVSS 3.0 · Vendor: huntr

Severity by source

Vendor (huntr) PRIMARY

5.5 MEDIUM

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

vuln.today AI

5.5 MEDIUM

Local file load required (AV:L); no attacker privileges needed (PR:N); victim must open file (UI:R); only confidentiality impacted via filesystem read.

3.1 AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

4.0 AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Red Hat

5.5 MEDIUM

qualitative

Primary rating from Vendor (huntr).

CVSS VectorVendor: huntr

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Patch available

Jul 01, 2026 - 18:02 EUVD

Analysis Generated

Jul 01, 2026 - 17:41 vuln.today

CVE Published

Jul 01, 2026 - 17:16 cve.org

MEDIUM 5.5

Blast Radius

ecosystem impact

† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth

1 pypi packages depend on keras (1 direct, 0 indirect)

Ecosystem-wide dependent count for version 3.13.0.

DescriptionCVE.org

Keras versions up to and including 3.13.2 are vulnerable to an arbitrary HDF5 file read due to an incomplete fix for CVE-2026-1669. The vulnerability resides in the H5IOStore._verify_dataset() and file_editor.py methods, which fail to check the dataset.is_virtual property of HDF5 datasets. This allows an attacker to craft a malicious .keras model archive or .h5 weights file containing a Virtual Dataset (VDS) that references external HDF5 files on the victim's filesystem. When the victim loads the model using keras.models.load_model() or keras.saving.load_model(), the external file is transparently read, leading to potential information disclosure. Fixed in versions 3.12.2 and 3.14.1.

AnalysisAI

Arbitrary HDF5 file read in Keras up to 3.13.2 enables information disclosure when a victim loads a crafted model file, representing an incomplete patch for the prior CVE-2026-1669. The flaw lies in two specific code paths - H5IOStore._verify_dataset() and file_editor.py - which omit the dataset.is_virtual check, allowing a malicious HDF5 Virtual Dataset (VDS) to silently redirect reads to attacker-specified paths on the local filesystem. No public exploit code has been identified at time of analysis, and this vulnerability is not listed in the CISA KEV catalog, but the attack surface is realistic in ML supply chain and model-sharing contexts.

Technical ContextAI

HDF5 (Hierarchical Data Format version 5) is a binary file format widely used in scientific computing and machine learning to store model weights and datasets. The HDF5 Virtual Dataset (VDS) feature, introduced in HDF5 1.10, allows a single logical dataset to transparently aggregate data from multiple external HDF5 files at arbitrary filesystem paths. Keras uses HDF5 for its .h5 weights format and internally as part of the .keras archive format. CWE-73 (External Control of File Name or Path) is the root cause class: the application allows externally supplied data - here, the VDS source path baked into the model file - to control which filesystem resource is accessed, without sufficient validation. The prior fix for CVE-2026-1669 addressed some VDS-related checks but missed the is_virtual property check in at least two distinct code paths, leaving a bypass. No CPE strings were provided in the source data; the affected component is the keras-team/keras Python package.

RemediationAI

Upgrade to Keras 3.12.2 or 3.14.1, both of which contain the corrected is_virtual check. The patch commit is available at https://github.com/keras-team/keras/commit/d5a88bdb137c0d3039b8f4bbbe8c7099925cc10c. Users on the 3.13.x branch should migrate directly to 3.14.1, as no 3.13.x patch was issued. As a compensating control where immediate upgrade is not possible, restrict the process running Keras to the minimum necessary filesystem permissions (e.g., via a container or OS-level read restriction), so that VDS-referenced paths outside the model directory are inaccessible. Additionally, enforce model provenance policies: only load .keras and .h5 files from verified, signed sources or internal registries. Scanning model archives for embedded VDS paths before loading (via h5py inspection of is_virtual flags) can serve as a detection layer with no operational side effects. Note that the earlier CVE-2026-1669 fix alone is insufficient - this CVE represents a bypass of that fix in two additional code paths.