{"data":{"id":"fd41f1e1-7520-4977-9059-6d7881659466","title":"CVE-2026-48705: MONAI (Medical Open Network for AI) is an AI toolkit for health care imaging. Prior to 1.6.1…","summary":"MONAI, an AI toolkit for healthcare imaging, has a flaw in PydicomReader._get_affine() prior to 1.6.1: it accepts non-finite values in the DICOM PixelSpacing, ImagePositionPatient, and ImageOrientationPatient fields and builds an affine matrix from them without validation. An unauthenticated attacker who can upload a crafted DICOM to a default MONAILabel deployment can propagate NaN or infinity values through LoadImaged, Spacingd, model inference, and output writing. The result is inference failures, persistent datastore poisoning, or geometrically corrupted results.","solution":"Fixed in version 1.6.1.","labels":["security","industry"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-48705","publishedAt":"2026-11-05T21:18:50.270Z","cveId":"CVE-2026-48705","cweIds":["CWE-20","CWE-682"],"cvssScore":"9.3","cvssSeverity":"critical","severity":"critical","attackType":["denial_of_service","model_poisoning"],"issueType":"vulnerability","affectedPackages":["monai@< 1.6.1 (fixed: 1.6.1)"],"affectedPackageNames":["monai"],"affectedPackageRefs":["pypi:monai"],"affectedVendors":[],"affectedVendorsRaw":["MONAI","MONAILabel"],"classifierModel":"claude-haiku-5-5","classifierPromptVersion":"v4","summaryPromptVersion":"v2","headline":"MONAI PydicomReader affine computation accepts non-finite DICOM values","headlinePromptVersion":"h1","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:L","attackVector":"network","attackComplexity":"low","privilegesRequired":"none","userInteraction":"none","exploitMaturity":"unknown","epssScore":0,"epssCheckedAt":"2026-11-06T06:09:43.478Z","kevDateAdded":null,"advisoryAliases":["GHSA-6hp3-vr39-rqw8"],"affectedPackagesSource":"ghsa","affectedPackagesCheckedAt":"2026-11-06T06:09:50.115Z","patchAvailable":true,"disclosureDate":"2026-11-05T21:18:50.270Z","fixReleasedAt":"2026-09-27T19:40:21.758Z","daysToFix":-39,"fixCheckedAt":"2026-11-06T06:09:53.005Z","capecIds":null,"crossRefCount":0,"attackSophistication":"trivial","impactType":["integrity","availability"],"aiComponentTargeted":"inference","llmSpecific":false,"classifierConfidence":0.9,"researchCategory":null,"atlasIds":null,"fixes":[{"ecosystem":"pypi","name":"monai","fixedVersion":"1.6.1","matchedVersion":"1.6.1","fixReleasedAt":"2026-09-27T19:40:21.758Z","daysToFix":-39,"match":"ecosystem","source":"registry","status":"found","checkedAt":"2026-11-06T06:09:53.001Z"}]}}