CVE-2026-48705 Details

A vulnerability exists in MONAI (Medical Open Network for AI) versions prior to 1.6.1, specifically within the PydicomReader component. The issue arises because the _get_affine() method does not properly validate DICOM metadata values related to PixelSpacing, ImagePositionPatient, and ImageOrientationPatient. This lack of validation allows non-finite values, such as NaN and infinity, to be incorporated into an affine transformation matrix. An unauthenticated attacker can exploit this vulnerability by uploading a crafted DICOM file to a MONAILabel deployment, leading to inference failures, persistent datastore poisoning, or geometrically corrupted results. The vulnerability is rooted in improper input validation, allowing incorrect calculations that disrupt the application's functionality.

Users can update to MONAI version 1.6.1 or later, where this vulnerability has been addressed. In the updated version, the PydicomReader._get_affine() method includes validation checks that reject non-finite values in the DICOM metadata before constructing the affine matrix. Additionally, MONAILabel's REST API now validates the spatial metadata of uploaded DICOM files, ensuring that only geometrically correct data is accepted.