MONAI accepts non-finite DICOM geometry values, corrupting inference
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- None · High · Low
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub.
Summary
MONAI before 1.6.1 trusts DICOM PixelSpacing, ImagePositionPatient and ImageOrientationPatient values without validation. Non-finite values are composed into an affine matrix in PydicomReader._get_affine() (CWE-20). An unauthenticated remote attacker who can upload a crafted DICOM file to a default MONAILabel deployment can cause inference failures, datastore poisoning or geometrically corrupted results.
Written with Claude Haiku 5.5 from the sources below · 2026-11-06
Description from the CNA
MONAI (Medical Open Network for AI) is an AI toolkit for health care imaging. Prior to 1.6.1, PydicomReader._get_affine() trusts non-finite values in the DICOM PixelSpacing, ImagePositionPatient, and ImageOrientationPatient fields and composes them into an affine matrix without validation. An unauthenticated attacker who can upload a crafted DICOM to a default MONAILabel deployment can propagate NaN or infinity values through LoadImaged, Spacingd, model inference, and output writing, causing inference failures, persistent datastore poisoning, or geometrically corrupted results. This issue is fixed in version 1.6.1.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- Poc
- Automatable
- Yes
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Project-MONAI | MONAI | before 1.6.1 | 1.6.1 | Patch available | CNA |
| — | monai (PyPI) | before 1.6.1 | 1.6.1 | Patch available | GHSA-6hp3-vr39-rqw8 |
- MONAI VendorProject-MONAI Affected before 1.6.1 Fixed in 1.6.1 Patch available CNA
- monai (PyPI) Vendor— Affected before 1.6.1 Fixed in 1.6.1 Patch available GHSA-6hp3-vr39-rqw8
Remediation
Upgrade MONAI to version 1.6.1, which fixes the issue in the MONAI and monai PyPI package.
Written with Claude Haiku 5.5 from the sources below · 2026-11-06
- Fix · CNA MONAI (Project-MONAI) Fixed in 1.6.1
- Fix · GHSA-6hp3-vr39-rqw8 monai (PyPI) Fixed in 1.6.1 Advisory →
Timeline
- 2026-11-05 Threatist record created from CVE-2026-48705
- 2026-11-05 CISA SSVC decision points changed
- 2026-11-05 Priority changed: MEDIUM → HIGH
References
Other 5
- https://github.com/Project-MONAI/MONAI/security/advisories/GHSA-6hp3-vr39-rqw8
- https://github.com/Project-MONAI/MONAI/pull/9087
- https://github.com/Project-MONAI/MONAI/commit/434c094a3e6b84cca5b6e81da51e0d18a0100607
- https://github.com/Project-MONAI/MONAI/releases/tag/1.6.1
- https://github.com/Project-MONAI/MONAI
More Project-MONAI vulnerabilities
- TI-2026-64984 MONAI before 1.5.2 Remote Code Execution via Pickle Deserialization CVSS 4.0HIGH 8.8
- TI-2025-36415 MONAI's unsafe use of Pickle deserialization may lead to RCE CVSS 3.1HIGH 8.8
- TI-2026-83080 Remote code execution in MONAI Auto3DSeg algo_from_json() CVSS 4.0HIGH 8.5
- TI-2026-64983 MONAI before 1.6.0 Remote Code Execution via NumpyReader CVSS 4.0HIGH 8.5
- TI-2026-64982 MONAI before 1.6.0 OS Command Injection via dataset_name_or_id CVSS 4.0HIGH 8.6
- TI-2026-64981 MONAI before 1.6.0 Remote Code Execution via algo_from_pickle CVSS 4.0HIGH 8.5
Sources
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences