Non-validated DICOM Data Processing Vulnerability in MONAI by Project MONAI

CVE-2026-48705

What is CVE-2026-48705?

In versions prior to 1.6.1 of MONAI, the PydicomReader component contains a flaw where it fails to validate non-finite values in critical DICOM fields. An attacker could exploit this by uploading a specially crafted DICOM file, leading to the incorporation of NaN or infinite values into the affine matrix. This vulnerability can result in inference failures and persistent datastore contamination, subsequently causing corrupted imaging outputs. The issue has been addressed in version 1.6.1, enhancing the integrity of DICOM handling and model inference processes.

References