What is the CVSS score of CVE-2026-12484?

CVE-2026-12484 has a CVSS 3.0 base score of 7.8 (High). CVSS vector: CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of Keras are affected by CVE-2026-12484?

Keras 3.15.0 contains an arbitrary code execution vulnerability triggered when deserializing externally sourced or user-supplied model configurations, creating risk for organizations that accept…. A patch is available.

How to fix or mitigate CVE-2026-12484?

Within 24 hours, inventory all applications and pipelines using Keras 3.15.0, prioritizing systems that load third-party, user-supplied, or externally sourced model configurations; restrict or isolate these workflows pending remediation. Within 7 days, implement compensating controls: enforce SafeModeScope(True) context when deserializing Keras layers, restrict model loading to trusted internal sources only, and add input validation for model files. Within 30 days, monitor vendor security advisories for a patched Keras release; establish a deployment plan to upgrade to the patched version or migrate to an alternative framework if internal mitigations prove insufficient.

Keras CVE-2026-12484

EUVD-2026-45872 HIGH

Deserialization of Untrusted Data (CWE-502)

2026-07-19 security@huntr.dev

GHSA-v2w2-w228-c444

RCE Deserialization

7.8

CVSS 3.0 · Vendor: huntr

Severity by source

Vendor (huntr) PRIMARY

7.8 HIGH

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

vuln.today AI

7.8 HIGH

Exploitation needs a victim to load an untrusted config (AV:L, UI:R) with no auth (PR:N), and unpickling yields full code execution, so C/I/A all High.

3.1 AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

4.0 AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Red Hat

7.8 HIGH

qualitative

Primary rating from Vendor (huntr).

CVSS VectorVendor: huntr

CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 19, 2026 - 20:30 vuln.today

CVE Published

Jul 19, 2026 - 20:16 cve.org

HIGH 7.8

Blast Radius

ecosystem impact

† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth

1 pypi packages depend on keras (1 direct, 0 indirect)

Ecosystem-wide dependent count for version 3.13.0.

DescriptionCVE.org

A vulnerability in keras-team/keras version 3.15.0 allows unsafe deserialization of attacker-controlled PyTorch pickle data through the public keras.layers.TorchModuleWrapper.from_config method. This method invokes torch.load(..., weights_only=False) without requiring an explicit unsafe opt-in, such as a safe_mode=False parameter. When called outside a SafeModeScope(True) context, the absence of an ambient safe mode state permits unsafe deserialization by default. This issue can lead to arbitrary code execution if untrusted Keras layer configurations are processed using this method. The vulnerability arises because the method does not enforce safe deserialization practices unless explicitly guarded by Keras safe mode.

AnalysisAI

Arbitrary code execution in keras-team/keras 3.15.0 arises because the public keras.layers.TorchModuleWrapper.from_config method calls torch.load(..., weights_only=False) without any explicit unsafe opt-in, so a maliciously crafted Keras layer configuration deserialized outside a SafeModeScope(True) context triggers execution of attacker-controlled PyTorch pickle payloads (CWE-502). Any application or pipeline that loads untrusted or third-party Keras model/layer configs is affected; CVSS is 7.8 (High) with a local vector requiring user interaction. There is no public exploit identified at time of analysis and the flaw is not listed in CISA KEV, but the vulnerability class is well understood and reliably weaponizable via standard pickle reduce gadgets.

Technical ContextAI

Keras is a high-level neural-network API; version 3 (Keras Core) supports multiple backends including PyTorch, and TorchModuleWrapper is the adapter that embeds a native torch.nn.Module inside a Keras layer. Model/layer serialization in Keras round-trips through get_config/from_config dictionaries, and for the Torch wrapper the persisted state is restored via torch.load. PyTorch's torch.load defaults to the pickle protocol, and with weights_only=False it will unpickle arbitrary Python objects - invoking __reduce__ methods that can run any code during load. The root cause (CWE-502, Deserialization of Untrusted Data) is that from_config performs this unsafe load unconditionally: Keras has a safe-mode mechanism (SafeModeScope) intended to block unsafe deserialization, but this code path only honors it when a SafeModeScope(True) is already active and provides no per-call safe_mode=False gate, so the insecure behavior is the default rather than an explicit, audited opt-in.

RemediationAI

No vendor-released patch version is identified in the provided data, so a specific fixed release cannot be cited - consult the huntr advisory (https://huntr.com/bounties/ab14df49-13b5-4442-b754-3189430bfa28) and the keras-team/keras releases for an upgraded version and apply it once published. As the primary compensating control, never call TorchModuleWrapper.from_config (or deserialize Keras models/layers) on configurations from untrusted or unverified sources; treat model files like executable code. Where deserialization of external configs is unavoidable, wrap the operation in a SafeModeScope(True) context so Keras safe mode blocks the unsafe torch.load path - with the trade-off that legitimate configs relying on that Torch-wrapper load will fail and must be sourced only from trusted parties. Additionally, isolate model-loading in a sandboxed, least-privilege process or container without network egress or sensitive credentials to limit blast radius if a hostile config is loaded, accepting the added operational complexity of a separate deserialization service.