Is CVE-2026-12484 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-12484 being exploited in the wild.

How severe is CVE-2026-12484?

High severity, with a CVSS score of 7.8, published 19 July 2026.

Which products and versions are affected?

keras (PyPI) ECOSYSTEM:introduced=0,fixed=3.12.3, ECOSYSTEM:introduced=0,fixed=3.12.3,introduced=3.13.0,fixed=3.15.0.

Is there a fix for CVE-2026-12484?

Yes. keras (PyPI): upgrade to 3.12.3, 3.15.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-12484 attacked?

It is attacked with local access, in a software library.

Am I affected by CVE-2026-12484?

Check whether you run keras (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-12484: Keras unsafe deserialization in TorchModuleWrapper

CVE-2026-12484 · Severity: high · CVSS 7.8 · Published 2026-07-19

Keras, a popular deep learning library, contains a vulnerability in how it handles certain PyTorch-based model layers. If a user is tricked into loading a specially crafted, untrusted model configuration file, an attacker could execute arbitrary code on the user's system. This occurs because the software fails to enforce security restrictions by default when processing these specific model components.

Technologies: keras (PyPI). Vendors: PyPI.

Quick answers

Is CVE-2026-12484 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-12484 being exploited in the wild.
How severe is CVE-2026-12484?: High severity, with a CVSS score of 7.8, published 19 July 2026.
Which products and versions are affected?: keras (PyPI) ECOSYSTEM:introduced=0,fixed=3.12.3, ECOSYSTEM:introduced=0,fixed=3.12.3,introduced=3.13.0,fixed=3.15.0.
Is there a fix for CVE-2026-12484?: Yes. keras (PyPI): upgrade to 3.12.3, 3.15.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-12484 attacked?: It is attacked with local access, in a software library.
Am I affected by CVE-2026-12484?: Check whether you run keras (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

keras (PyPI): upgrade to 3.12.3, 3.15.0 or later
```
pip install "keras>=3.15.0"
```

Technical details

A deserialization vulnerability exists in `keras.layers.TorchModuleWrapper.from_config` due to the unsafe use of `torch.load(..., weights_only=False)`. The root cause is a "fail-open" logic where the method does not enforce Keras's internal `safe_mode` unless explicitly wrapped in a `SafeModeScope(True)` or provided with a `safe_mode=False` parameter. An attacker can provide a malicious Keras layer configuration containing a PyTorch pickle payload; when deserialized, this payload can execute arbitrary Python code. The issue was addressed by changing the default behavior to "fail-closed," requiring explicit opt-in for unsafe deserialization. Fixes are available in versions 3.12.3 and 3.15.0.

Affected products

Keras Team Keras < 3.12.3, >= 3.13.0, < 3.15.0

Identifiers

CVE-2026-12484
GHSA-v2w2-w228-c444
PYSEC-2026-3634

Timeline

2026-06-06: patched: Initial fix submitted via PR 23048
2026-07-19: advisory: GitHub Advisory and NVD record published
2026-08-07: other: Advisory reviewed and updated by GitHub staff

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.