External risk intelligence

MONAI PydicomReader Affine Matrix Corruption Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 9.3)

CVE-2026-48705

The vulnerability involves MONAILabel, an AI toolkit for medical imaging. While it can be deployed as an internet-facing service for research or remote diagnostics, such tools are frequently used within internal hospital networks or restricted research environments. Public exposure is possible but not the default or intended standard for all deployments.

Halo Surface Signal: 3 out of 5 — possibly public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This vulnerability affects the MONAI AI toolkit used in healthcare imaging, specifically its ability to process medical image data. If exploited, it could lead to inaccurate AI model inferences, corrupted data, or disruptions in analysis, potentially impacting research and diagnostic capabilities. The primary concern is confirming if MONAILabel is deployed in a way that could be exposed to this risk.

Unvalidated image data can corrupt AI analysis.
Affects AI used for healthcare imaging.
Confirm relevance and exposure of deployed systems.

Attack Path

How an attacker could exploit the issue

An unauthenticated attacker could upload a specially crafted DICOM file to a MONAI Label deployment. The application would process non-finite values in specific DICOM fields, leading to unintended consequences during AI model inference and output generation. This could result in corrupted data or system failures.

Attacker uploads a malicious DICOM file.
Vulnerable code processes untrusted DICOM metadata.
Data corruption, inference failure, or poisoned datastore.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could affect AI model inference and data integrity within the MONAI framework. When supported by the advisory, an unauthenticated attacker could upload a crafted DICOM file. This crafted file could introduce non-finite values into critical image metadata fields, leading to corrupted inference results, poisoned datastores, or general inference failures.

Affected: AI model inference and data integrity.
Exposure: Uploading crafted DICOM files.
Consequence: Corrupted results or datastore poisoning.

Operational Fix

Recommended remediation, mitigation, and detection steps

This vulnerability in MONAI's PydicomReader affects AI healthcare imaging applications, potentially leading to inference failures or data corruption. The first step is to identify all MONAI deployments, confirm their exposure and criticality, and locate the accountable owners. Remediation planning should then prioritize high-risk systems, involving coordination with vendor-management if necessary.

Identify affected systems and owners.
Verify external reachability and criticality.
Plan remediation based on risk.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is MONAI and how is it used?

MONAI, or Medical Open Network for AI, is an open-source framework built for healthcare imaging. It provides tools that help researchers and clinicians train and deploy AI models for tasks like image analysis and segmentation. The framework simplifies complex workflows by handling medical data formats, specifically DICOM files, to ensure AI models can accurately interpret biological structures.

What does CVE-2026-48705 mean for data accuracy?

This vulnerability involves improper input validation, categorized under CWE-20 and CWE-682. Because the software fails to check for non-finite values like 'NaN' or 'infinity' in specific DICOM metadata fields, these invalid values get processed into a mathematical affine matrix. This error causes the software to misinterpret spatial image data, which can lead to incorrect AI inferences or corrupted results.

How does an attacker trigger this vulnerability?

An attacker triggers this by uploading a specially crafted DICOM file to a MONAI Label deployment. The vulnerability relies on the system accepting and processing this untrusted metadata without checks. If the system does not allow arbitrary DICOM uploads from unauthenticated users, or if it validates image metadata before processing, the conditions for this specific flaw are not met.

Do I need to worry if my MONAI deployment is internal?

According to Halo Surface Signal, public exposure is possible but not the default for MONAI deployments. While internet-facing instances are at higher risk of unauthorized file uploads, internal hospital networks or restricted research environments are safer. You should assess whether your specific deployment is reachable from outside your network to determine your immediate risk level.

When should I take action to secure my systems?

You should prioritize securing your systems immediately by identifying all MONAI deployments in your environment. Confirm which instances are affected by checking if they are running a version prior to 1.6.1. The primary practical response is to update these instances to version 1.6.1 or newer, which includes the necessary validation logic to prevent processing these malicious values.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.