# CVE-2026-48705: MONAI MONAILabel server crash and inference corruption via crafted DICOM

Source: https://junglewise.ai/threats/cve-2026-48705-monailabel-server-crash-and-silent-inference-corruption-via  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-11-05. Updated: 2026-10-27  
License: CC BY 4.0 with a link back

CVE-2026-48705 · Severity: critical · CVSS 9.3 · Published 2026-11-05

MONAILabel is a medical imaging AI platform that processes DICOM files to perform automated segmentation. An unauthenticated attacker can upload a single malformed DICOM file to crash the inference pipeline and corrupt segmentation results, affecting all legitimate users. The attack requires only network access and bypasses validation in both the underlying pydicom library and MONAI itself.

Technologies: [monai (PyPI)](https://junglewise.ai/threats/technologies/monai). Vendors: [PyPI](https://junglewise.ai/threats/vendors/pypi).

## Quick answers

**Is CVE-2026-48705 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-48705 being exploited in the wild.

**How severe is CVE-2026-48705?** Critical severity, with a CVSS score of 9.3, published 5 November 2026.

**Which products and versions are affected?** MONAI Project MONAI Core affects PydicomReader and spatial transform components; MONAI Project MONAI Deploy App SDK affects DICOMDataLoaderOperator; Pydicom 0.9.7 through 3.0.2; monai (PyPI) < 1.6.1, ECOSYSTEM:introduced=0,fixed=1.6.1.

**Is there a fix for CVE-2026-48705?** Yes. monai (PyPI): upgrade to 1.6.1 or later. Until then: Restrict network access to the MONAILabel REST API to trusted clients only; disable the PUT /datastore/ endpoint or require authentication if possible; validate spatial metadata (PixelSpacing, ImagePositionPatient, ImageOrientationPatient) for finite values before storing or processing DICOM files.</anigation>
<parameter name="timeline">[
  {
    "kind": "disclosed",
    "at": "2026-10-27",
    "note": "Advisory GHSA-6hp3-vr39-rqw8 published"
  },
  {
    "kind": "other",
    "at": "2026-04-05",
    "note": "Upstream pydicom vulnerability filed"
  }
] Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-48705 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-48705?** Check whether you run MONAI Project MONAI Core, MONAI Project MONAI Deploy App SDK, MONAI Project MONAILabel or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- monai (PyPI): upgrade to 1.6.1 or later

  ```sh
  pip install "monai>=1.6.1"
  ```


Restrict network access to the MONAILabel REST API to trusted clients only; disable the PUT /datastore/ endpoint or require authentication if possible; validate spatial metadata (PixelSpacing, ImagePositionPatient, ImageOrientationPatient) for finite values before storing or processing DICOM files.</anigation>
<parameter name="timeline">[
  {
    "kind": "disclosed",
    "at": "2026-10-27",
    "note": "Advisory GHSA-6hp3-vr39-rqw8 published"
  },
  {
    "kind": "other",
    "at": "2026-04-05",
    "note": "Upstream pydicom vulnerability filed"
  }
]

## Technical details

The vulnerability stems from pydicom accepting NaN and infinity values in Decimal String (DS) and Integer String (IS) DICOM value representations, which the DICOM standard prohibits. MONAI's PydicomReader trusts pydicom output without isfinite() checks and propagates these invalid values through spatial transforms and the ML inference pipeline. The MONAILabel REST API accepts DICOM uploads without authentication or validation, allowing remote attackers to permanently poison the datastore or cause RuntimeError crashes during inference.

## Affected products

- MONAI Project MONAILabel
- MONAI Project MONAI Core affects PydicomReader and spatial transform components
- MONAI Project MONAI Deploy App SDK affects DICOMDataLoaderOperator
- pydicom pydicom 0.9.7 through 3.0.2

## Identifiers

- CVE-2026-48705
- GHSA-6hp3-vr39-rqw8

## Related threats

- [MONAI unsafe deserialization in algo_from_pickle](https://junglewise.ai/threats/cve-2026-100846-monai-before-1-5-2-contains-a-deserialization-of-untrusted-data)
- [MONAI unsafe deserialization in NumpyReader](https://junglewise.ai/threats/cve-2026-100845-monai-before-1-6-0-contains-an-unsafe-deserialization)
- [MONAI OS command injection in nnUNetV2Runner](https://junglewise.ai/threats/cve-2026-100844-monai-before-1-6-0-is-vulnerable-to-os-command-injection-in-the)
- [MONAI remote code execution in algo_from_pickle](https://junglewise.ai/threats/cve-2026-100843-monai-versions-before-1-6-0-contain-a-remote-code-execution)
- [MONAI eval injection in _get_fake_spatial_shape](https://junglewise.ai/threats/cve-2026-100842-monai-through-1-6-0-contains-an-eval-injection-vulnerability-in)