Live › vulnerability › CVE-2026-16305
INFINITT PACS medical imaging software has a local privilege escalation flaw in SmartUpdate.exe and SmartExecute.exe. A low-privileged local user who edits the world-writable execlist.txt command manifest can get arbitrary commands run with administrator rights during an application update.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-11-02 21:35 UTC. All times on this page are UTC.
Hospitals and clinics running INFINITT PACS System Manager 3.0.11.3 or 3.0.11.5 on Windows workstations or servers where low-privileged users can log in. The attacker needs a local account and edits execlist.txt before an update is approved; SmartExecute.exe then runs the commands with administrative rights, possibly after a UAC prompt. Systems already on 3.0.12.3 or 3.0.12.5, or without other local users, can skip it.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| INFINITT PACS System Manager | vendor | >= 3.0.11.3, <= 3.0.11.5 | 3.0.12.3, 3.0.12.5 |
Upgrade INFINITT PACS System Manager to 3.0.12.3 or 3.0.12.5 (per CERT/CC VU#203719, relaying INFINITT Healthcare's recommendation).
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Local privilege escalation in SmartUpdate.exe and SmartExecute.exe in INFINITT Healthcare Co., Ltd. INFINITT PACS allows a local low-privileged attacker to execute arbitrary commands with administrator privileges via modification of a world-writable execlist.txt command manifest that is processed during application updates.
This page as .md · .json · in your agent: get_signal("CVE-2026-16305")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.