Arbitrary HDF5 File Read in Keras

Executive Summary

This vulnerability affects Keras versions up to and including 3.13.2 and involves an arbitrary HDF5 file read due to an incomplete fix for a previous issue (CVE-2026-1669). The problem lies in the methods `H5IOStore._verify_dataset()` and `file_editor.py`, which do not properly check the `dataset.is_virtual` property of HDF5 datasets.

An attacker can craft a malicious .keras model archive or .h5 weights file containing a Virtual Dataset (VDS) that references external HDF5 files on the victim's filesystem. When the victim loads this model using `keras.models.load_model()` or `keras.saving.load_model()`, the external file is read transparently, potentially exposing sensitive information.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can lead to information disclosure by allowing an attacker to read arbitrary files on the victim's filesystem. Specifically, by loading a malicious model or weights file, the victim's system may unknowingly read external HDF5 files referenced by a Virtual Dataset, exposing potentially sensitive data.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability involves loading malicious Keras model files (.keras or .h5) that contain Virtual Datasets (VDS) referencing external HDF5 files. Detection would involve identifying usage of vulnerable Keras versions (up to 3.13.2) and monitoring or scanning for suspicious model files that may contain VDS.

Since the vulnerability is triggered when loading models using keras.models.load_model() or keras.saving.load_model(), you can detect attempts by monitoring logs or tracing calls to these functions.

There are no explicit commands provided in the resources to detect this vulnerability on your system or network.

Useful 0 Not Useful 0

Mitigation Strategies

The immediate mitigation step is to upgrade Keras to a fixed version. The vulnerability is fixed in versions 3.12.2 and 3.14.1, so upgrading to one of these or a later version will resolve the issue.

Additionally, avoid loading untrusted or unauthenticated .keras or .h5 model files, as these could contain malicious Virtual Datasets that exploit this vulnerability.

Useful 0 Not Useful 0