This vulnerability involves external control of file name or path (CWE-73) in the Keras model loading process using HDF5 external dataset references. An attacker can craft a malicious .keras model file that, when loaded, triggers reading of arbitrary local files, leading to sensitive information disclosure (CWE-200). The affected versions are Keras 3.0.0 through 3.13.1. The CVSS 4.0 base score is 7.1, indicating high severity, with network attack vector, low attack complexity, no privileges required, and user interaction needed. No official patch or fix is referenced in the vendor advisory or Red Hat advisory, and no known exploits are reported in the wild.

Successful exploitation allows a remote attacker to read arbitrary local files on the system where the vulnerable Keras version loads a crafted model file. This can lead to disclosure of sensitive information. The vulnerability does not require privileges or authentication but does require user interaction to load the malicious model file. There is no indication of code execution or system compromise beyond information disclosure.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch is referenced in the provided vendor advisory or Red Hat advisory. Users should avoid loading untrusted or unauthenticated .keras model files that may contain malicious HDF5 external dataset references. Monitor vendor channels for updates or patches addressing this vulnerability.