Is CVE-2026-100845 being exploited?

No public exploit is currently tracked.

How severe is CVE-2026-100845?

CVE-2026-100845 has a CVSS v3 severity of HIGH (7.8).

Back

CVE-2026-100845

Description

MONAI before 1.6.0 contains an unsafe deserialization vulnerability in the NumpyReader class that unconditionally uses numpy.load with allow_pickle=True when loading .npy and .npz files. Attackers can craft malicious .npy files with pickle payloads that execute arbitrary code when loaded through MONAI's standard data pipeline.