pydicom DS/IS NaN/inf validation bypass → MONAILabel crash & silent inference corruption (CVE-2026-48705)
Severity: critical · Patch status: patched · Since 2026-10-27 · CVE-2026-48705
An unauthenticated remote attacker can crash a MONAILabel server or silently corrupt medical AI inference results by uploading a single crafted ~132 KB DICOM file via the default unauthenticated REST API (PUT /datastore/, port 8000). The root cause is pydicom's lack of validation for Decimal String (DS) and Integer String (IS) VRs, silently accepting 'NaN', 'inf' and scientific-notation IS values (affects pydicom 0.9.7–3.0.2). MONAI's PydicomReader builds affine matrices from PixelSpacing/ImagePositionPatient with no isfinite checks, propagating NaN/inf through all spatial transforms and inference; MONAILabel performs no metadata validation. PoC confirmed 17/17 test vectors against MONAI 1.5.2/pydicom 3.0.2, causing HTTP 500 crashes (~16s wasted compute per request) with the malicious DICOM persisting in the datastore. MONAI 1.6.1 fixes the issue; pydicom remains unfixed.
What to do
- Upgrade MONAI to 1.6.1 or later immediately
- Restrict network access to MONAILabel port 8000 and enable authentication on the REST API
- Purge/audit datastore entries for DICOM files with NaN/inf in PixelSpacing or ImagePositionPatient (they permanently crash inference)
- Add input validation on DICOM spatial metadata before ingestion if running custom pipelines
- Monitor for HTTP 500 inference errors and unexpected datastore uploads
- Track pydicom for a fix to DS/IS validation; consider RAISE validation mode as a mitigation
Fixed versions
Sources
All live incidents on Threat Watch
