CVE Intelligence
Analysis AI-assisted

CVE-2025-49655: Keras deserialization flaw lets malicious model files run code despite safe mode

CVE-2025-49655 is a deserialization of untrusted data weakness (CWE-502) in the Keras framework. According to the record, a crafted Keras file containing a TorchModuleWrapper class can run arbitrary code when loaded, even with safe mode enabled. The CNA scores it CVSS 3.1 9.8 (Critical), and the record shows no KEV listing.

Published Oct 13, 2026 · Updated Oct 13, 2026 · Ler em português

Overview

CVE-2025-49655 is a deserialization of untrusted data weakness (CWE-502) in the Keras framework. According to the record, a crafted Keras file that includes a TorchModuleWrapper class can run arbitrary code when loaded, even with safe mode enabled. The record states that the issue can be triggered through both local and remote files.

Impact

  • Arbitrary code execution on the end user system when a malicious file is loaded.
  • The CNA assigned a CVSS 3.1 base score of 9.8 (Critical), with network attack vector, no privileges required, no user interaction, and high impact on confidentiality, integrity and availability.
  • Safe mode is described as enabled in the scenario, yet the record indicates it does not prevent the code execution.

Affected products and versions

  • The description states that versions 3.11.0 up to but not including 3.11.3 are affected.
  • The record contains no structured affected or fixed version lists, so the range is taken from the description text only.
  • The record does not provide a full version history, so other releases cannot be assessed from it.

Exploitation status

  • The KEV data in the record shows the CVE is not listed. No confirmed exploitation in the wild appears in the sources consulted.
  • The EPSS probability is recorded as 0.0075 with a percentile of 0.53729.

Remediation and mitigation

  • Upgrade Keras to version 3.11.3 or later, which is the first version not described as affected.
  • Until upgraded, do not load Keras model files from untrusted or unverified sources, including files retrieved from remote locations.
  • Treat model files as executable content: limit who can supply them and load them in isolated environments with least privilege.
  • Review the upstream pull request and the HiddenLayer advisory for fix details.

Detection guidance

  • Inventory Python environments and deployments that use Keras and record installed versions.
  • Review pipelines that ingest model files from external sources and log model loading events.
  • Monitor model training and serving processes for unexpected child processes or outbound network connections.

Limitations of the available information

  • The record has no structured affected product, fixed version or KEV detail fields.
  • The EPSS date is listed as 2026-10-13, which is later than the publication date, so its meaning should be verified at the source.
  • The record does not include technical exploitation details, and this analysis does not add any.

Frequently asked questions

Which Keras versions does CVE-2025-49655 affect?

The record's description states that versions 3.11.0 up to but not including 3.11.3 are affected. The structured affected-version fields are empty, so the description is the only source for this range.

Is CVE-2025-49655 known to be exploited in the wild?

The record shows the CVE is not listed in CISA KEV, and no confirmed exploitation appears in the sources consulted.

What should administrators do first?

Upgrade Keras to 3.11.3 or later, and avoid loading model files from untrusted sources until the upgrade is complete.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.