# CVE-2026-12484: Keras unsafe deserialization in TorchModuleWrapper

Source: https://junglewise.ai/threats/cve-2026-12484-keras-unsafe-deserialization-in-torchmodulewrapper  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-19. Updated: 2026-08-07  
License: CC BY 4.0 with a link back

CVE-2026-12484 · Severity: high · CVSS 7.8 · Published 2026-07-19

Keras, a popular deep learning library, contains a vulnerability in how it handles certain PyTorch-based model layers. If a user is tricked into loading a specially crafted, untrusted model configuration file, an attacker could execute arbitrary code on the user's system. This occurs because the software fails to enforce security restrictions by default when processing these specific model components.

Technologies: [keras (PyPI)](https://junglewise.ai/threats/technologies/keras). Vendors: [PyPI](https://junglewise.ai/threats/vendors/pypi).

## Quick answers

**Is CVE-2026-12484 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-12484 being exploited in the wild.

**How severe is CVE-2026-12484?** High severity, with a CVSS score of 7.8, published 19 July 2026.

**Which products and versions are affected?** keras (PyPI) ECOSYSTEM:introduced=0,fixed=3.12.3, ECOSYSTEM:introduced=0,fixed=3.12.3,introduced=3.13.0,fixed=3.15.0.

**Is there a fix for CVE-2026-12484?** Yes. keras (PyPI): upgrade to 3.12.3, 3.15.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-12484 attacked?** It is attacked with local access, in a software library.

**Am I affected by CVE-2026-12484?** Check whether you run keras (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- keras (PyPI): upgrade to 3.12.3, 3.15.0 or later

  ```sh
  pip install "keras>=3.15.0"
  ```


## Technical details

A deserialization vulnerability exists in `keras.layers.TorchModuleWrapper.from_config` due to the unsafe use of `torch.load(..., weights_only=False)`. The root cause is a "fail-open" logic where the method does not enforce Keras's internal `safe_mode` unless explicitly wrapped in a `SafeModeScope(True)` or provided with a `safe_mode=False` parameter. An attacker can provide a malicious Keras layer configuration containing a PyTorch pickle payload; when deserialized, this payload can execute arbitrary Python code. The issue was addressed by changing the default behavior to "fail-closed," requiring explicit opt-in for unsafe deserialization. Fixes are available in versions 3.12.3 and 3.15.0.

## Affected products

- Keras Team Keras < 3.12.3, >= 3.13.0, < 3.15.0

## Identifiers

- CVE-2026-12484
- GHSA-v2w2-w228-c444
- PYSEC-2026-3634

## Timeline

- 2026-06-06: patched: Initial fix submitted via PR 23048
- 2026-07-19: advisory: GitHub Advisory and NVD record published
- 2026-08-07: other: Advisory reviewed and updated by GitHub staff

## References

- [https://huntr.com/bounties/ab14df49-13b5-4442-b754-3189430bfa28](https://huntr.com/bounties/ab14df49-13b5-4442-b754-3189430bfa28)
- [https://github.com/keras-team/keras/pull/23048](https://github.com/keras-team/keras/pull/23048)
- [https://github.com/keras-team/keras/pull/23165](https://github.com/keras-team/keras/pull/23165)
- [https://github.com/keras-team/keras/commit/55888d3becbdbb45dc16a55b489900f911e2dde5](https://github.com/keras-team/keras/commit/55888d3becbdbb45dc16a55b489900f911e2dde5)
- [https://github.com/keras-team/keras/commit/d338a45204bdc787c8b3c4a9b82c1911cd52dedf](https://github.com/keras-team/keras/commit/d338a45204bdc787c8b3c4a9b82c1911cd52dedf)

## Related threats

- [Keras model loading denial of service via HDF5 shape bombs](https://junglewise.ai/threats/cve-2026-12570-keras-model-loading-denial-of-service-via-hdf5-shape-bombs)
- [Keras HDF5 arbitrary file disclosure via ExternalLinks](https://junglewise.ai/threats/cve-2026-9335-keras-hdf5-arbitrary-file-disclosure-via-externallinks)
- [Keras path traversal via symlink in filter_safe_tarinfos](https://junglewise.ai/threats/cve-2026-12482-keras-path-traversal-via-symlink-in-filter-safe-tarinfos)
- [Keras Team Keras arbitrary code execution in Lambda layer](https://junglewise.ai/threats/cve-2026-12481-keras-team-keras-arbitrary-code-execution-in-lambda-layer)
- [Keras arbitrary HDF5 file read in model loading](https://junglewise.ai/threats/cve-2026-12480-keras-arbitrary-hdf5-file-read-in-model-loading)