CVE-2026-12484: Unsafe Deserialization in keras.layers.TorchModuleWrapper.from_config
A vulnerability in keras-team/keras version 3.15.0 allows unsafe deserialization of attacker-controlled PyTorch pickle data through the public keras.layers.TorchModuleWrapper.fromconfig method. This method invokes torch.load(..., weightsonly=False) without requiring an explicit unsafe opt-in, such as a safemode=False parameter. When called outside a SafeModeScope(True) context, the absence of an ambient safe mode state permits unsafe deserialization by default. This issue can lead to arbitrary code execution if untrusted Keras layer configurations are processed using this method. The vulnerability arises because the method does not enforce safe deserialization practices unless explicitly guarded by Keras safe mode.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Ensure untrusted Keras layer configurations are processed only within a SafeModeScope(True) context so that TorchModuleWrapper.from_config enforces safe deserialization instead of default unsafe torch.load(..., weights_only=False).
keras.layers.TorchModuleWrapper.from_config SafeModeScope (ambient safe mode context) = True
Event History
Frequently Asked Questions
What is the severity of CVE-2026-12484?
CVE-2026-12484 has a high severity score of 7.8.
How does CVE-2026-12484 affect software security?
CVE-2026-12484 allows unsafe deserialization of attacker-controlled PyTorch pickle data, potentially leading to remote code execution.
How do I fix CVE-2026-12484?
To fix CVE-2026-12484, upgrade to a patched version of keras that addresses the unsafe deserialization issue.
What versions of Keras are affected by CVE-2026-12484?
CVE-2026-12484 affects Keras version 3.15.0.
Is CVE-2026-12484 a zero-day vulnerability?
CVE-2026-12484 is not a zero-day vulnerability as it was published on July 19, 2026.