CVE-2026-12484 Unsafe Deserialization in keras.layers.TorchModuleWrapper.from_config
Attackers can execute arbitrary code by providing malicious PyTorch pickle data to the TorchModuleWrapper.from_config method in Keras.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2026-12484?
CVE-2026-12484 is a high-severity unsafe deserialization vulnerability in keras-team/keras, published on 19 Jul 2026. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.
Official description
A vulnerability in keras-team/keras version 3.15.0 allows unsafe deserialization of attacker-controlled PyTorch pickle data through the public `keras.layers.TorchModuleWrapper.from_config` method. This method invokes `torch.load(..., weights_only=False)` without requiring an explicit unsafe opt-in, such as a `safe_mode=False` parameter. When called outside a `SafeModeScope(True)` context, the absence of an ambient safe mode state permits unsafe deserialization by default. This issue can lead to arbitrary code execution if untrusted Keras layer configurations are processed using this method. The vulnerability arises because the method does not enforce safe deserialization practices unless explicitly guarded by Keras safe mode.
Weakness: CWE-502
Which versions are affected by CVE-2026-12484?
5 open source packages ship an affected version, including keras.
| Package | Affected | Fixed in |
|---|---|---|
keras PyPI | All versions | 3.12.3, 3.15.0 |
keras PyPI | All versions | 3.12.3 |
keras PyPI | All versions | 3.12.3 |
keras PyPI | From 3.13.0 | 3.15.0 |
keras PyPI | From 3.13.0 | 3.15.0 |
How do I fix CVE-2026-12484?
Upgrade keras to a fixed version for your release line: 3.12.3 or 3.15.0.
Upgrade, and only deserialise data from trusted sources or with an allow-list of types. More about Unsafe deserialization.
Is CVE-2026-12484 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-12484 exists.
Sources
Also known as DEBIAN-CVE-2026-12484, GHSA-v2w2-w228-c444, MINI-x5m7-w2pq-c3wv, PYSEC-2026-3634, UBUNTU-CVE-2026-12484.