CriticalVulnerability

CVE-2026-12481: keras-team/keras Lambda layer code execution through unsafe deserialization

Source: NVD(opens in a new tab)
Identifier: CVE-2026-12481
Published: July 3, 2026
Record updated: October 9, 2026

Affected: keras < 3.12.3, fixed in 3.12.3
keras >= 3.13.0, < 3.15.0, fixed in 3.15.0
Known exploitation: Not listed in the CISA Known Exploited Vulnerabilities catalog at the last check.
EPSS: 0.7%

Summary

CVE-2026-12481 affects keras-team/keras version 3.14.0. The _raise_for_lambda_deserialization() function fails to enforce the safe-mode guard when safe_mode is None, the default outside a SafeModeScope context, because it conflates None with False. This lets attacker-controlled marshal bytecode be deserialized through keras.layers.deserialize(config), keras.models.clone_model(model) and direct Lambda.from_config(config) calls, enabling arbitrary OS-level code execution in the server or user process.

Mitigation

The source does not state a fix yet. Check the original advisory for updates.

Details

Scores and exploitation

Patch available: Yes
EPSS: 0.7%Estimated probability that this CVE is exploited in the next 30 days, from the FIRST Exploit Prediction Scoring System. Read on October 11, 2026.
Disclosure date: July 3, 2026

Weaknesses and techniques

Weakness (CWE): CWE-502
Attack pattern (CAPEC): CAPEC-586

Affected

Packages: keras@< 3.12.3 (fixed: 3.12.3)
keras@>= 3.13.0, < 3.15.0 (fixed: 3.15.0)

Classification

Attack type: Other
Attack sophistication: Moderate
AI component targeted: Framework
Impact: Confidentiality,
Integrity,
Availability
Labels: security

How this record was produced

Summaries, mitigations and labels on this page are generated automatically from the source. The linked source is authoritative. The source gives this advisory a description and no title, so the title above is a headline generated from the source text.

Original source: https://nvd.nist.gov/vuln/detail/CVE-2026-12481

First tracked: July 4, 2026 at 02:02 AM ET, from NVD/CVE Database

Classifier: claude-haiku-5-5, prompt v4

Classifier confidence: 95% (self-assessed)

Affected packages in the Exposure Registry

Matched by package name and ecosystem. Each entry shows whether the package delegates to a language model and how many tracked packages depend on it.

kerasPyPINo LLM dependency detected · 6 tracked dependents

Summary

Mitigation

Affected packages in the Exposure Registry

Related items