CVE-2026-48705

MONAI accepts non-finite medical-image geometry into inference

Project MONAI · MONAI PydicomReader / MONAILabel

First documented disclosure · Review checkpoint

Summary

A crafted DICOM upload can disrupt inference or contaminate spatial results.

Severity and exploitation evidence

Critical · 9.3/10 · CVSS 3.1. Severity source.

Exploitation not established: The report describes controlled upload and inference tests. No malicious deployment or patient impact is documented.

Exploitation evidence source

Technical severity is not a measure of observed attacks or of risk to your deployment. Attempts, demonstrations, and successful compromise retain the qualifications in the source.

How the weakness works

The image reader accepts NaN or infinity in geometry metadata and carries those values into the affine transform and downstream processing.

Conditions required

The attacker can submit a DICOM image to an affected pipeline. The demonstrated default MONAILabel upload API has no authentication.

Potential impact

Research shows persistent malicious images and failing inference requests. Silent geometric corruption is a stated risk; clinical harm and production compromise are not established.

Affected versions and configurations

CNA: before 1.6.1. Research tested MONAI 1.5.2 and pydicom 3.0.2.

Fix and mitigation status

MONAI 1.6.1 contains the finite-value validation change.

Practical next steps

Upgrade MONAI, restrict upload access, validate geometry before inference and quarantine previously accepted invalid images.

Operating lesson

Validate scientific metadata before it reaches model transformations or persistent datasets.

Evidence and limits

The public September 3 PR names this flaw; 1.6.1 was published September 27 and the advisory October 13. The CNA assigns 9.3 CVSS 3.1; advisory prose says 8.7 for the same vector and has inconsistent version shorthand. The explicit CNA range and tagged fix are used here.

Sources