External risk intelligence

Keras Deserialization Vulnerability Allows Arbitrary Code Execution.

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2025-49655

Keras is a machine learning framework library used within software applications, not a standalone network-facing service, gateway, or appliance. The vulnerability requires a user to load a malicious file into an application utilizing the library, which is a local processing action typical of developer-centric or data science environments rather than a directly exposed public internet service.

Deserialization

Halo Surface Signal: 1 out of 5 — much less likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A vulnerability in the Keras machine learning framework allows attackers to execute arbitrary code by tricking users into loading a specially crafted file. This could potentially impact systems that use this framework for processing machine learning models.

Malicious files can run code when loaded.
Machine learning processing could be compromised.
Confirm if Keras is used in your environment.

Attack Path

How an attacker could exploit the issue

An attacker could trick a user into loading a specially crafted Keras file into an application. This file, containing a malicious `TorchModuleWrapper` class, would then be deserialized, allowing arbitrary code execution even when safe mode is enabled.

Requires loading a malicious file.
Deserialization of untrusted data.
Arbitrary code execution.

Live Threat

Current exploitation, exposure, and threat context

When supported by the advisory, a maliciously crafted Keras file could allow for arbitrary code execution on a user's system during file loading, even when safe mode is enabled. This could occur with both locally and remotely sourced files.

Arbitrary code execution on user systems.
Loading a malicious Keras file.
System compromise and data theft.

Operational Fix

Recommended remediation, mitigation, and detection steps

Teams managing machine learning platforms and the applications that consume them should address this deserialization vulnerability. The initial step is to locate all instances of the affected Keras framework, determine their exposure, and identify the accountable application or platform owner. Subsequent remediation planning should be risk-based, considering factors like criticality and reachability.

Identify application and platform owners.
Verify local and remote file loading exposure.
Plan remediation based on risk assessment.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the Keras framework?

Keras is a high-level open-source library used by developers and data scientists to build, train, and deploy deep learning models. It acts as an interface for complex numerical computations, allowing researchers to rapidly prototype neural networks. Because it is integrated directly into custom software applications to handle model processing, it is not a standalone server but rather a component that executes code based on the data files it is given.

How does CWE-502 apply to CVE-2025-49655?

This CVE involves Deserialization of Untrusted Data (CWE-502). In this context, it means the Keras framework automatically reconstructs objects from data files without sufficient verification. When Keras processes a specially crafted file containing a TorchModuleWrapper class, it treats the embedded data as instructions, which allows the software to inadvertently run malicious code instead of just loading a saved machine learning model.

Do I need to be online for this to happen?

No, an internet connection is not required to trigger the vulnerability. While the flaw allows malicious files to be loaded remotely, it is equally dangerous when a user manually loads a local file from a disk or a shared drive. The critical precondition is simply the action of opening or loading a compromised Keras file into an application that uses the affected versions of the library.

Why does Halo Surface Signal call this unlikely to be exposed?

Halo Surface Signal notes that because Keras is a library embedded within applications, it lacks a direct network-facing service like a web gateway. The risk is not from open ports, but from internal workflows where developers or automated systems process untrusted model files. Exposure is tied to the specific applications that ingest outside data, rather than the library's status on the public internet.

What should I do if I use Keras?

Start by auditing your software inventory to locate every application that relies on Keras versions 3.11.0 through 3.11.2. Once identified, map these applications to their respective internal owners to assess where untrusted model files might be loaded. Since this process is often part of automated data pipelines, prioritize environments that handle externally sourced model files for urgent review.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.