Is CVE-2026-12481 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-12481 being exploited in the wild.

How severe is CVE-2026-12481?

High severity, with a CVSS score of 8.8, published 3 July 2026.

Which products and versions are affected?

keras (PyPI) ECOSYSTEM:introduced=0,fixed=3.12.3, ECOSYSTEM:introduced=0,fixed=3.12.3,introduced=3.13.0,fixed=3.15.0.

Is there a fix for CVE-2026-12481?

Yes. keras (PyPI): upgrade to 3.12.3, 3.15.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-12481 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-12481?

Check whether you run keras (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-12481: Keras Team Keras arbitrary code execution in Lambda layer

CVE-2026-12481 · Severity: high · CVSS 8.8 · Published 2026-07-03

Keras, a popular machine learning library, contains a vulnerability that could allow an attacker to execute malicious code on a user's system. The issue exists in how the library handles certain model components (Lambda layers) during the loading process, failing to properly enforce security restrictions. If a user is tricked into loading a specially crafted malicious model file, an attacker could gain full control over the underlying server or workstation.

Technologies: keras (PyPI). Vendors: PyPI.

Quick answers

Is CVE-2026-12481 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-12481 being exploited in the wild.
How severe is CVE-2026-12481?: High severity, with a CVSS score of 8.8, published 3 July 2026.
Which products and versions are affected?: keras (PyPI) ECOSYSTEM:introduced=0,fixed=3.12.3, ECOSYSTEM:introduced=0,fixed=3.12.3,introduced=3.13.0,fixed=3.15.0.
Is there a fix for CVE-2026-12481?: Yes. keras (PyPI): upgrade to 3.12.3, 3.15.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-12481 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-12481?: Check whether you run keras (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

keras (PyPI): upgrade to 3.12.3, 3.15.0 or later
```
pip install "keras>=3.15.0"
```

Technical details

A logic error in the `_raise_for_lambda_deserialization()` function and `TorchModuleWrapper.from_config()` fails to enforce safe-mode guards when `safe_mode` is set to `None` (the default state outside of a `SafeModeScope`). The library conflates this `None` value with `False`, allowing the deserialization of attacker-controlled `marshal` bytecode or `torch.load()` pickles. Attackers can exploit this by providing a malicious configuration to call sites such as `keras.layers.deserialize()`, `keras.models.clone_model()`, or direct `Lambda.from_config()` calls. Successful exploitation results in arbitrary OS-level code execution in the context of the process. The issue is patched in versions 3.12.3 and 3.15.0 by ensuring the library fails closed when safe mode is unset.

Affected products

Keras Team Keras < 3.12.3, >= 3.13.0, < 3.15.0

Identifiers

CVE-2026-12481
GHSA-5gwj-m78q-7pq3
PYSEC-2026-3631

Timeline

2026-06-06: patched: Initial fix submitted via PR 23048
2026-07-03: disclosed: Vulnerability disclosed and CVE-2026-12481 assigned
2026-07-03: advisory: GitHub Advisory published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.