MONAI DICOM geometry flaw crashes MONAILabel server and corrupts results
Uploading a suspicious scan file to a medical AI server can stop it or skew its results!
Summary
The PydicomReader in MONAI accepts NaN and infinity values in DICOM spacing and position fields without checking them. On a default MONAILabel server, an unauthenticated attacker who uploads a crafted DICOM file can crash inference or silently corrupt results.
Affected when
- Default MONAILabel server
- REST API reachable over the network
What to do
Update MONAI to 1.6.1 or later.
Products and platforms
CVE IDs
Sources
- Write-up: github.com (opens in a new tab)
- CVE record: cve.org (opens in a new tab)
Times
First published
First seen