The vulnerability resides in Keras team releases through version 3.14.0, where the KerasFileEditor and keras.saving.load_weights functions bypass safety checks that are meant to reject HDF5 ExternalLinks and SoftLinks. This improper handling leads to automatic dereferencing of links to external HDF5 files, which means that a maliciously crafted .h5, .weights.h5, or .keras file can expose any local files that the process can read. The primary impact is disclosure of sensitive data from the victim's local filesystem rather than remote code execution or denial of service.

Keras versions 3.14.0 and earlier, across any operating system that employs the KerasFileEditor or load_weights routines to load user‑supplied HDF5 model or weight files.

The CVSS score of 6.5 indicates a moderate severity vulnerability. The EPSS score is listed as less than 1%, suggesting an extremely low likelihood of exploitation in the wild. It is not presently catalogued in the CISA KEV. Attackers would need the ability to supply a malicious HDF5 file to the Keras application, either via a file upload or by directing the program to load a specific file path. Once present, the vulnerability allows local disclosure of any files that the executing user has access to, but does not provide a remote code execution path.