CVE-2026-16305

Unknown

Published: 02/11/2026(UTC)Translated: 02/11/2026(UTC)NVD NIST

Summary

Local privilege escalation in SmartUpdate.exe and SmartExecute.exe in INFINITT PACS. A local low-privileged attacker can modify the world-writable execlist.txt command manifest processed during application updates to execute arbitrary commands with administrator privileges.

Risk Assessment

An attacker with local access to a workstation can gain full administrative rights and take over the system, potentially leading to compromise of medical data or further lateral movement.

Recommendation

Restrict write access to execlist.txt to administrators only, apply the vendor patch from INFINITT, and monitor the integrity of update configuration files.

Other vulnerabilities in INFINITT PACS

CVE-2026-16306Unknown
In INFINITT PACS (INFINITT Healthcare Co., Ltd.), the IModular.exe URI handler allows a remote unauthenticated attacker to invoke unintended application functionality and potentially execute arbitrary code via a crafted imodular:// URI containing attacker-controlled command and argument parameters.

Original NVD description (English source)

Local privilege escalation in `SmartUpdate.exe` and `SmartExecute.exe` in INFINITT Healthcare Co., Ltd. INFINITT PACS allows a local low-privileged attacker to execute arbitrary commands with administrator privileges via modification of a world-writable `execlist.txt` command manifest that is processed during application updates.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS