CVE-2026-48705

    Dashboard / Vulnerabilities / CVE-2026-48705

    CVE-2026-48705

    Published: 5 Nov 2026Last Modified: 7 Nov 2026

    Summary: MONAI: MONAILabel Server Crash and Silent Inference Corruption via Crafted DICOM (pydicom DS/IS Validation Bypass)

    Details: MONAI (Medical Open Network for AI) is an AI toolkit for health care imaging. Prior to 1.6.1, PydicomReader._get_affine() trusts non-finite values in the DICOM PixelSpacing, ImagePositionPatient, and ImageOrientationPatient fields and composes them into an affine matrix without validation. An unauthenticated attacker who can upload a crafted DICOM to a default MONAILabel deployment can propagate NaN or infinity values through LoadImaged, Spacingd, model inference, and output writing, causing inference failures, persistent datastore poisoning, or geometrically corrupted results. This issue is fixed in version 1.6.1.

    References: https://github.com/Project-MONAI/MONAI/releases/tag/1.6.1, https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/48xxx/CVE-2026-48705.json, https://github.com/Project-MONAI/MONAI/security/advisories/GHSA-6hp3-vr39-rqw8, https://nvd.nist.gov/vuln/detail/CVE-2026-48705, https://github.com/Project-MONAI/MONAI/commit/434c094a3e6b84cca5b6e81da51e0d18a0100607, https://github.com/Project-MONAI/MONAI/pull/9087

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: GIT

    Events:

    Introduced- 0
    Fixed -f2ec87ae9b536baaeca1d6bcc2b6349369e2af8f

    Affected versions

    1.6.0rc1
    1.6.0

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    CVE-2026-48705 | CVE-DB