MediumVulnerability

CVE-2026-12480: Keras arbitrary HDF5 file read through virtual datasets in model loading

Source: NVD(opens in a new tab)
Identifier: CVE-2026-12480
Published: July 1, 2026
Record updated: October 9, 2026

Affected: keras < 3.12.3, fixed in 3.12.3
keras >= 3.13.0, < 3.15.0, fixed in 3.15.0
Known exploitation: Not listed in the CISA Known Exploited Vulnerabilities catalog at the last check.
EPSS: 0.2%

Summary

Keras versions up to and including 3.13.2 contain an arbitrary HDF5 file read flaw, an incomplete fix for CVE-2026-1669. The `H5IOStore._verify_dataset()` and `file_editor.py` methods do not check the `dataset.is_virtual` property, so a crafted `.keras` or `.h5` file with a Virtual Dataset can reference external HDF5 files on the victim's filesystem. Loading that model with `keras.models.load_model()` or `keras.saving.load_model()` transparently reads those files, which can disclose information.

Mitigation

Fixed in versions 3.12.2 and 3.14.1.

Details

Scores and exploitation

Patch available: Yes
EPSS: 0.2%Estimated probability that this CVE is exploited in the next 30 days, from the FIRST Exploit Prediction Scoring System. Read on October 14, 2026.
Disclosure date: July 1, 2026

Weaknesses and techniques

Weakness (CWE): CWE-73

Affected

Packages: keras@< 3.12.3 (fixed: 3.12.3)
keras@>= 3.13.0, < 3.15.0 (fixed: 3.15.0)

Classification

Attack type: Other
Attack sophistication: Moderate
AI component targeted: Framework
Impact: Confidentiality
Labels: security,
privacy

How this record was produced

Summaries, mitigations and labels on this page are generated automatically from the source. The linked source is authoritative. The source gives this advisory a description and no title, so the title above is a headline generated from the source text.

Original source: https://nvd.nist.gov/vuln/detail/CVE-2026-12480

First tracked: July 1, 2026 at 02:09 PM ET, from NVD/CVE Database

Classifier: claude-haiku-5-5, prompt v4

Classifier confidence: 93% (self-assessed)

Affected packages in the Exposure Registry

Matched by package name and ecosystem. Each entry shows whether the package delegates to a language model and how many tracked packages depend on it.

kerasPyPINo LLM dependency detected · 6 tracked dependents

Summary

Mitigation

Affected packages in the Exposure Registry

Related items