Arbitrary Code Execution in Keras Model Loading from .h5/.hdf5 Files
CVE-2025-9905

7.3HIGH

Key Information:

Vendor

Keras-team

Status
Keras
Vendor
CVE Published:
19 September 2025

What is CVE-2025-9905?

The Keras Model.load_model method is vulnerable to exploitation through specially crafted .h5/.hdf5 model archives. This manipulation can trigger arbitrary code execution, regardless of the safe_mode=True setting. The root of the issue lies in the Lambda layer feature of Keras, which permits arbitrary Python code in pickled format. The vulnerability stems from the failure to respect the safe_mode setting when processing .h5 archives, which are retained for compatibility in Keras 3.

Affected Version(s)

Keras 3.0.0 <= 3.11.2

References

https://github.com/keras-team/keras/pull/21602
patch
https://github.com/keras-team/keras/security/advisories/G...

CVSS V4

Score:
7.3
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
High
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Gabriele Digregorio
.
CVE-2025-9905 : Arbitrary Code Execution in Keras Model Loading from .h5/.hdf5 Files