MONAI PydicomReader trust of non-finite DICOM affine values lets unauthenticated attacker poison medical-AI datastore and corrupt inference

MONAI's DICOM reader composes attacker-controlled geometry fields into an affine matrix without checking for NaN or infinity, so a crafted image can inject non-finite values into the preprocessing/inference pipeline. This causes inference failures, persistent datastore poisoning, and geometrically corrupted results. CISA's SSVC assessment marks exploitation=poc and automatable=yes.

It is an unauthenticated, automatable integrity attack on a widely-deployed medical AI framework: a single crafted DICOM can persistently poison the training/inference store and silently corrupt diagnostic outputs, which is a data-integrity and availability risk rather than a simple crash.

PydicomReader._get_affine() composes PixelSpacing, ImagePositionPatient, and ImageOrientationPatient into an affine matrix without validating for non-finite values. An unauthenticated attacker who uploads a crafted DICOM to a default MONAILabel deployment propagates NaN/Infinity through LoadImaged, Spacingd, model inference and output writing.

MONAI < 1.6.1

Upgrade to MONAI 1.6.1. Advisory: https://github.com/Project-MONAI/MONAI/security/advisories/GHSA-6hp3-vr39-rqw8