A vulnerability exists in keras-team/keras versions <= 3.15.0 where the keras.models.load_model() function does not properly validate the shape or size of datasets in .keras model files. Specifically, the H5IOStore.__getitem__ method in keras/src/saving/saving_lib.py lacks checks, allowing an attacker to craft malicious .keras files that cause unbounded memory allocation. This can trigger an out-of-memory (OOM) condition, causing the process to terminate with exit code 137, resulting in a denial of service. This issue circumvents the previous fix for CVE-2026-0897, which addressed a similar vulnerability in KerasFileEditor. The vulnerability can be exploited by loading poisoned models from public repositories or malicious model registries, threatening machine learning workflows that process untrusted models.

Successful exploitation leads to denial of service by causing the Keras process to consume excessive memory and terminate unexpectedly. There is no confidentiality or integrity impact reported. The vulnerability affects availability of machine learning pipelines that load malicious .keras files.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, avoid loading .keras model files from untrusted or unverified sources to prevent potential denial of service. Monitor vendor channels for updates addressing this vulnerability.