The flaw lies in Keras 3.14.0’s Lambda layer deserialization logic, which mistakenly permits a deserialization when the safe_mode flag is unset (None) instead of treating it as denied. An attacker can supply model configuration data containing marshal bytecode that is executed when the configuration is loaded, leading to full OS‑level code execution for the process that runs the Keras code. This is a binary serialization flaw classified as CWE‑502.

The issue affects the Keras library provided by the keras‑team; it is present in release 3.14.0 and any code that uses keras.layers.deserialize, keras.models.clone_model, or Lambda.from_config outside a SafeModeScope(True).

The vulnerability carries a CVSS score of 8.8, indicating high severity, but its EPSS score is below 1 % and it is not listed in the CISA KEV catalog, suggesting a low likelihood of exploitation. Based on the description, the likely attack vector is that an attacker supplies a malicious model configuration to a system that performs deserialization, most commonly through an API or interface that accepts user‑provided model data. Once reached, the attacker can run arbitrary code as the user of the application.