Description

MONAI (Medical Open Network for AI) is an AI toolkit for health care imaging. Prior to 1.6.1, PydicomReader._get_affine() trusts non-finite values in the DICOM PixelSpacing, ImagePositionPatient, and ImageOrientationPatient fields and composes them into an affine matrix without validation. An unauthenticated attacker who can upload a crafted DICOM to a default MONAILabel deployment can propagate NaN or infinity values through LoadImaged, Spacingd, model inference, and output writing, causing inference failures, persistent datastore poisoning, or geometrically corrupted results. This issue is fixed in version 1.6.1.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.3",
  "pubDate": "2026-11-05T21:18:50.270Z",
  "pubdate": "2026-11-05T21:18:50.270Z",
  "executiveSummary": "A critical input validation vulnerability exists in MONAI (Medical Open Network for AI) versions prior to 1.6.1 within the PydicomReader._get_affine() function.\nThe vulnerability allows an unauthenticated attacker to inject non-finite values (NaN or infinity) into critical DICOM metadata fields, specifically PixelSpacing, ImagePositionPatient, and ImageOrientationPatient.\nBy failing to sanitize these inputs, the application constructs a malformed affine transformation matrix, which is then utilized throughout the internal processing pipeline.\nThe impact includes system-wide inference failures, persistent poisoning of the medical imaging datastore, and the generation of geometrically corrupted clinical results.\nThis flaw represents a significant risk to healthcare AI reliability, as it allows external actors to disrupt model performance or induce subtle, dangerous data corruption via crafted DICOM files.\nExploitation requires only the ability to upload a DICOM file to a default MONAILabel deployment, requiring no prior authentication or elevated privileges.",
  "technicalDetails": "The root cause of this vulnerability lies in the insufficient input sanitization within the PydicomReader._get_affine() function in MONAI versions prior to 1.6.1. The function directly reads geometric metadata from DICOM files and performs mathematical operations to compose an affine matrix without verifying the arithmetic validity of the input data.\nWhen a DICOM file containing non-finite values (NaN or infinity) in the PixelSpacing, ImagePositionPatient, or ImageOrientationPatient tags is processed, the resulting affine matrix inherits these non-finite states. Because this affine matrix is foundational to subsequent geometric operations, the corruption propagates through the LoadImaged and Spacingd transforms.\nThe attack flow commences when an unauthenticated attacker uploads a maliciously crafted DICOM file to an active MONAILabel deployment. The MONAI pipeline ingests the file, and the vulnerable _get_affine() method parses the contaminated headers. The resulting affine matrix, containing NaN/Inf, is then cached or processed by the inference engine.\nDuring model inference, these invalid values disrupt floating-point calculations, frequently leading to application crashes or exceptions. In scenarios where the operation completes, the geometric transformation applied to the imaging data becomes mathematically undefined or nonsensical. This results in the production of corrupted inference masks or diagnostic outputs.\nFurthermore, since these corrupted outputs can be written back to the datastore, the vulnerability facilitates persistent data poisoning. Future clinical analyses or subsequent model training cycles utilizing this corrupted datastore will perpetuate these geometric errors, potentially leading to incorrect diagnostic decision support. The lack of validation at the ingestion layer creates a bypass where the system blindly trusts external metadata, allowing the injection to persist downstream within the internal healthcare imaging pipeline."
}