CVE-2026-12480: Keras Arbitrary File Read via HDF5 Virtual Dataset Exploitation

Technical summary

CVE-2026-12480 is an arbitrary file read vulnerability in Keras that stems from incomplete remediation of CVE-2026-1669. The root cause lies in the `H5IOStore._verify_dataset()` and `file_editor.py` methods, which fail to inspect the `dataset.is_virtual` property when processing HDF5 datasets. Virtual Datasets (VDS) are a legitimate HDF5 feature that allow a dataset to reference external files; however, in this context, they become an attack surface. A malicious `.keras` archive or `.h5` weights file containing a VDS pointing to an arbitrary filesystem path will cause Keras to transparently access that external file during model deserialization via `keras.models.load_model()` or `keras.saving.load_model()`. The attacker gains read access without triggering file access errors or warnings. No code execution or authentication bypass occurs; the impact is strictly information disclosure.

Business impact

For organizations using Keras for model training, inference, or research, this vulnerability enables targeted information theft. A threat actor can distribute poisoned model files through collaboration platforms, public repositories, or supply-chain compromise and harvest sensitive data—configuration files, API keys, proprietary datasets, or other files readable by the process user. The attack requires user interaction (loading a model) but is difficult to detect because file reads occur silently during normal model loading. Organizations relying on untrusted or third-party model sources face elevated risk. The CVSS 5.5 score reflects the local attack vector and reliance on user interaction, but the practical impact in collaborative ML environments should not be underestimated.

Affected systems

Keras versions up to and including 3.13.2 are vulnerable. Fixed versions are Keras 3.12.2 and 3.14.1. Any system running an affected Keras version is at risk if it loads `.keras` or `.h5` model files from untrusted sources or from environments where an attacker can place malicious files. This includes development workstations, CI/CD pipelines, inference servers, and cloud ML platforms where Keras is used. The vulnerability does not require a specific operating system and affects Windows, Linux, and macOS deployments equally.

Exploitability

Exploitation requires an attacker to craft a malicious `.keras` or `.h5` file and convince a user to load it via `keras.models.load_model()` or `keras.saving.load_model()`. No special privileges, network access, or system misconfigurations are needed on the target system. However, the attacker must know or guess the filesystem path of the sensitive file they wish to read. The attack is not automated or wormable; it is targeted and opportunistic. Social engineering or supply-chain tactics would be required for large-scale exploitation. The fact that file reads occur silently without errors makes detection by end-users unlikely, giving attackers an advantage in scenarios where models are shared internally or downloaded from public sources.

Remediation

Upgrade Keras to version 3.12.2 or 3.14.1, depending on your dependency constraints. If you are on the 3.12.x branch, apply 3.12.2; if on 3.14.x or later, apply 3.14.1. Do not load `.keras` or `.h5` model files from untrusted sources until patched. If immediate patching is not feasible, restrict model loading to locally developed or cryptographically signed models, and limit process user privileges to reduce the impact of successful information disclosure.

Patch guidance

Consult the official Keras release notes and advisories to confirm patch version eligibility for your environment. The fixes address the `is_virtual` check in the HDF5 dataset verification logic. After patching, validate that your model loading pipelines still function as expected, particularly if you use advanced HDF5 features. If you maintain custom model loading code that bypasses Keras, audit it for similar `dataset.is_virtual` validation gaps.

Detection guidance

Monitor file access patterns during model loading in sensitive environments. Tools like auditd (Linux) or Endpoint Detection & Response (EDR) solutions can log unexpected file reads triggered by Python/Keras processes. In CI/CD and inference infrastructure, implement network segmentation and filesystem restrictions to limit the scope of data an attacker can exfiltrate. Code review of model source provenance and digital signatures can help prevent malicious models from reaching users. Runtime sandboxing of model loading operations is recommended for high-trust environments.

Why prioritize this

Although the CVSS score is moderate (5.5), the vulnerability should be prioritized because it affects a widely-used library, requires only user interaction to exploit, and enables silent data theft in collaborative ML environments. The fact that this is a regression of a previously patched vulnerability increases confidence in the threat model. Organizations with significant intellectual property in datasets, configurations, or models should treat this as high-priority.

Risk score, explained

The CVSS 3.0 score of 5.5 (MEDIUM) reflects a local attack vector (AV:L), low attack complexity (AC:L), no privilege requirement (PR:N), and reliance on user interaction (UI:R). The impact is high confidentiality (C:H) but no integrity or availability impact (I:N/A:N). This score is appropriate for a targeted information disclosure attack, but organizations should contextualize their risk based on model source trust levels and data sensitivity.

Frequently asked questions