CVE-2026-12480: Arbitrary HDF5 File Read via Virtual Dataset Bypass in keras-team/keras
Arbitrary HDF5 File Read via Virtual Dataset Bypass in keras-team/keras
Other sources
Keras versions up to and including 3.13.2 are vulnerable to an arbitrary HDF5 file read due to an incomplete fix for CVE-2026-1669. The vulnerability resides in the H5IOStore.verifydataset() and fileeditor.py methods, which fail to check the dataset.isvirtual property of HDF5 datasets. This allows an attacker to craft a malicious .keras model archive or .h5 weights file containing a Virtual Dataset (VDS) that references external HDF5 files on the victim's filesystem. When the victim loads the model using keras.models.loadmodel() or keras.saving.loadmodel(), the external file is transparently read, leading to potential information disclosure. Fixed in versions 3.12.2 and 3.14.1.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 3.3.3-8 - Upgrade
Upgrade
keras-team/kerasto a version that resolves this vulnerability.Fixed in 3.12.2 - Upgrade
Upgrade
keras-team/kerasto a version that resolves this vulnerability.Fixed in 3.14.1
Event History
Frequently Asked Questions
What is the severity of CVE-2026-12480?
CVE-2026-12480 has a medium severity rating of 5.5.
How do I fix CVE-2026-12480?
To fix CVE-2026-12480, update Keras to version 3.13.3 or later.
What type of vulnerability is CVE-2026-12480?
CVE-2026-12480 is an arbitrary file read vulnerability affecting HDF5 files.
Who is affected by CVE-2026-12480?
Users of Keras versions up to and including 3.13.2 are affected by CVE-2026-12480.
What causes the vulnerability in CVE-2026-12480?
The vulnerability in CVE-2026-12480 is caused by an incomplete fix related to HDF5 dataset verification.