Live › vulnerability › CVE-2026-16306
IModular.exe, the handler for the imodular:// URI scheme in INFINITT PACS, runs the cmd value from a link without checking that it is permitted. If a user opens a crafted link, an attacker can make it run specific programs from a local folder or network share, or open files the attacker controls. The url parameter also makes it connect to an attacker-controlled SignalR endpoint. Code runs with that user's privileges. CERT/CC reports no known exploitation.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-11-02 16:24 UTC. All times on this page are UTC.
Hospitals and clinics running INFINITT PACS System Manager 3.0.11.3 or 3.0.11.5 on Windows workstations where IModular.exe registers the imodular:// handler. Exploitation needs a user to open a crafted imodular:// link (browser, email or document), and code then runs with that user's privileges. Systems without INFINITT PACS, or already on 3.0.12.3/3.0.12.5, can skip it.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| INFINITT PACS System Manager | vendor | 3.0.11.3, 3.0.11.5 | 3.0.12.3, 3.0.12.5 |
Upgrade INFINITT PACS System Manager to or (per CERT/CC VU#203719, relaying INFINITT's recommendation).
3.0.12.33.0.12.5Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Remote Code Execution in the IModular.exe URI handler in INFINITT Healthcare Co., Ltd. INFINITT PACS allows a remote unauthenticated attacker to invoke unintended application functionality and potentially execute arbitrary code via a crafted imodular:// URI containing attacker-controlled command and argument parameters.
This page as .md · .json · in your agent: get_signal("CVE-2026-16306")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.