This vulnerability (CVE-2025-49655) involves unsafe deserialization in the Keras framework's TorchModuleWrapper class due to torch.load() deserializing model data with weights_only set to False, causing fallback to Python's pickle module. Since pickle can execute arbitrary code during deserialization, a malicious model file could lead to arbitrary code execution. Red Hat's advisory notes that their products do not allow remote upload of model files by default, limiting attack vectors. No official patch or fix is currently available, and mitigation options are either unavailable or unsuitable per Red Hat's criteria. The vulnerability is classified under CWE-502 (Deserialization of Untrusted Data) and has a Red Hat-assigned CVSS v3 score of 8.4 (high severity) with local attack vector, low complexity, no privileges or user interaction required, and high impact on confidentiality, integrity, and availability.

If exploited, this vulnerability allows an attacker to execute arbitrary code on the system by loading a maliciously crafted AI/ML model file. This can compromise confidentiality, integrity, and availability of the affected system. However, Red Hat products in their default configuration do not permit remote upload of model files, which limits the risk of remote exploitation. There are no known exploits in the wild at this time.

Red Hat currently does not provide a fix or patch for this vulnerability. The vendor states that mitigation options are either unavailable or do not meet their criteria for deployment and stability. Since remote upload of model files is not allowed by default in Red Hat products, this configuration reduces exposure. Users should restrict model file sources to trusted origins and avoid loading untrusted model files. Monitor Red Hat advisories for any future updates or fixes.