Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
MONAI (Medical Open Network for AI) is an AI toolkit for health care imaging. Prior to 1.6.1, PydicomReader._get_affine() trusts non-finite values in the DICOM PixelSpacing, ImagePositionPatient, and ImageOrientationPatient fields and composes them into an affine matrix without validation. An unauthenticated attacker who can upload a crafted DICOM to a default MONAILabel deployment can propagate NaN or infinity values through LoadImaged, Spacingd, model inference, and output writing, causing inference failures, persistent datastore poisoning, or geometrically corrupted results. This issue is fixed in version 1.6.1.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
NONE
Momentum
STABLE
🆕 New CVE Project-MONAI MONAI: MONAILabel Server Crash and Silent Inference Corruption (CVE-2026-48705) Patch → 1.6.1 https://cve.now/CVE-2026-48705?utm_source=x&utm_medium=social&utm_campaign=cvedotnow&utm_content=critical
💥 New CVE with a public exploit: CVE-2026-48705 (CVSS 9.3) MONAI: MONAILabel Server Crash and Silent Inference Corruption via Crafted DICOM (pydicom DS/IS Validation Bypass) Remote, no login needed. MONAI (Medical Open Network for AI) is an AI toolkit… https://app.enclave.ai/threat-feed/CVE-2026-48705
CVE-2026-48705: CVSS 9.3 critical advisory is out MONAI (Medical Open Network for AI) is an AI toolkit for health care imaging. Prior to 1.6.1, PydicomReader._get_affine() trusts non-finite values in the DICOM PixelSpacing, ImagePositionPatient, and ImageOrientationPatient fields and composes them into an affine matrix without validation. https://github.com/Project-MONAI/MONAI/commit/434c094a3e6b84cca5b6e81da51e0d18a0100607 #CyberSecurity #InfoSec #ThreatIntel #AI #AISecurity #LLM #AIAgents #GenAI #VulnerabilityManagement #PatchManagement
MONAI's MONAILabel server can be crashed, or made to return silently wrong segmentations, by a crafted DICOM upload: CVE-2026-48705 (CVSS 9.3, PydicomReader._get_affine() accepts NaN and inf values). VulnTracker recommends updating MONAI to 1.6.1 or later and requiring authentication on the MONAILabel API. Details: http://vulntracker.io/cves/CVE-2026-48705 #MONAI #CVE #VulnTracker
CVE-2026-48705: CVSS 9.3 critical advisory is out MONAI (Medical Open Network for AI) is an AI toolkit for health care imaging. Prior to 1.6.1, PydicomReader._get_affine() trusts non-finite values in the DICOM PixelSpacing, ImagePositionPatient, and ImageOrientationPatient fields and composes them into an affine matrix without validation. https://github.com/Project-MONAI/MONAI/commit/434c094a3e6b84cca5b6e81da51e0d18a0100607 #CyberSecurity #InfoSec #ThreatIntel #AI #AISecurity #LLM #AIAgents #GenAI #VulnerabilityManagement #PatchManagement
CVE-2026-48705: CVSS 9.3 critical advisory is out MONAI (Medical Open Network for AI) is an AI toolkit for health care imaging. Prior to 1.6.1, PydicomReader._get_affine() trusts non-finite values in the DICOM PixelSpacing, ImagePositionPatient, and ImageOrientationPatient fields and composes them into an affine matrix without validation. https://github.com/Project-MONAI/MONAI/commit/434c094a3e6b84cca5b6e81da51e0d18a0100607 #CyberSecurity #InfoSec #ThreatIntel #AI #AISecurity #LLM #AIAgents #GenAI #VulnerabilityManagement #PatchManagement
CVE-2026-48705: CVSS 9.3 critical advisory is out MONAI (Medical Open Network for AI) is an AI toolkit for health care imaging. Prior to 1.6.1, PydicomReader._get_affine() trusts non-finite values in the DICOM PixelSpacing, ImagePositionPatient, and ImageOrientationPatient fields and composes them into an affine matrix without validation. https://github.com/Project-MONAI/MONAI/commit/434c094a3e6b84cca5b6e81da51e0d18a0100607 #CyberSecurity #InfoSec #ThreatIntel #AI #AISecurity #LLM #AIAgents #GenAI #VulnerabilityManagement #PatchManagement
CVE-2026-48705: CVSS 9.3 critical advisory is out MONAI (Medical Open Network for AI) is an AI toolkit for health care imaging. Prior to 1.6.1, PydicomReader._get_affine() trusts non-finite values in the DICOM PixelSpacing, ImagePositionPatient, and ImageOrientationPatient fields and composes them into an affine matrix without validation. https://github.com/Project-MONAI/MONAI/commit/434c094a3e6b84cca5b6e81da51e0d18a0100607 #CyberSecurity #InfoSec #ThreatIntel #AI #AISecurity #LLM #AIAgents #GenAI #VulnerabilityManagement #PatchManagement
CVE-2026-48705: CVSS 9.3 critical advisory is out MONAI (Medical Open Network for AI) is an AI toolkit for health care imaging. Prior to 1.6.1, PydicomReader._get_affine() trusts non-finite values in the DICOM PixelSpacing, ImagePositionPatient, and ImageOrientationPatient fields and composes them into an affine matrix without validation. https://github.com/Project-MONAI/MONAI/commit/434c094a3e6b84cca5b6e81da51e0d18a0100607 #CyberSecurity #InfoSec #ThreatIntel #AI #AISecurity #LLM #AIAgents #GenAI #VulnerabilityManagement #PatchManagement
CVE-2026-48705: CVSS 9.3 critical advisory is out MONAI (Medical Open Network for AI) is an AI toolkit for health care imaging. Prior to 1.6.1, PydicomReader._get_affine() trusts non-finite values in the DICOM PixelSpacing, ImagePositionPatient, and ImageOrientationPatient fields and composes them into an affine matrix without validation. https://github.com/Project-MONAI/MONAI/commit/434c094a3e6b84cca5b6e81da51e0d18a0100607 #CyberSecurity #InfoSec #ThreatIntel #AI #AISecurity #LLM #AIAgents #GenAI #VulnerabilityManagement #PatchManagement
CVE-2026-48705: CVSS 9.3 critical advisory is out MONAI (Medical Open Network for AI) is an AI toolkit for health care imaging. Prior to 1.6.1, PydicomReader._get_affine() trusts non-finite values in the DICOM PixelSpacing, ImagePositionPatient, and ImageOrientationPatient fields and composes them into an affine matrix without validation. https://github.com/Project-MONAI/MONAI/commit/434c094a3e6b84cca5b6e81da51e0d18a0100607 #CyberSecurity #InfoSec #ThreatIntel #AI #AISecurity #LLM #AIAgents #GenAI #VulnerabilityManagement #PatchManagement
CVE-2026-48705: CVSS 9.3 critical advisory is out MONAI (Medical Open Network for AI) is an AI toolkit for health care imaging. Prior to 1.6.1, PydicomReader._get_affine() trusts non-finite values in the DICOM PixelSpacing, ImagePositionPatient, and ImageOrientationPatient fields and composes them into an affine matrix without validation. https://github.com/Project-MONAI/MONAI/commit/434c094a3e6b84cca5b6e81da51e0d18a0100607 #CyberSecurity #InfoSec #ThreatIntel #AI #AISecurity #LLM #AIAgents #GenAI #VulnerabilityManagement #PatchManagement
CVE-2026-48705: CVSS 9.3 critical advisory is out MONAI (Medical Open Network for AI) is an AI toolkit for health care imaging. Prior to 1.6.1, PydicomReader._get_affine() trusts non-finite values in the DICOM PixelSpacing, ImagePositionPatient, and ImageOrientationPatient fields and composes them into an affine matrix without validation. https://www.cve.org/CVERecord?id=CVE-2026-48705 #CyberSecurity #InfoSec #ThreatIntel #AI #AISecurity #LLM #AIAgents #GenAI #VulnerabilityManagement #PatchManagement
CVE-2026-48705: CVSS 9.3 critical advisory is out MONAI (Medical Open Network for AI) is an AI toolkit for health care imaging. Prior to 1.6.1, PydicomReader._get_affine() trusts non-finite values in the DICOM PixelSpacing, ImagePositionPatient, and ImageOrientationPatient fields and composes them into an affine matrix without validation. https://www.cve.org/CVERecord?id=CVE-2026-48705 #CyberSecurity #InfoSec #ThreatIntel #AI #AISecurity #LLM #AIAgents #GenAI #VulnerabilityManagement #PatchManagement
CVE-2026-48705: CVSS 9.3 critical advisory is out MONAI (Medical Open Network for AI) is an AI toolkit for health care imaging. Prior to 1.6.1, PydicomReader._get_affine() trusts non-finite values in the DICOM PixelSpacing, ImagePositionPatient, and ImageOrientationPatient fields and composes them into an affine matrix without validation. https://www.cve.org/CVERecord?id=CVE-2026-48705 #CyberSecurity #InfoSec #ThreatIntel #AI #AISecurity #LLM #AIAgents #GenAI #VulnerabilityManagement #PatchManagement