CVE-2026-16306

Unknown

Published: 02/11/2026(UTC)Updated: 02/11/2026(UTC)Translated: 02/11/2026(UTC)NVD NIST

Summary

In INFINITT PACS (INFINITT Healthcare Co., Ltd.), the IModular.exe URI handler allows a remote unauthenticated attacker to invoke unintended application functionality and potentially execute arbitrary code via a crafted imodular:// URI containing attacker-controlled command and argument parameters.

Risk Assessment

A remote unauthenticated attacker can execute arbitrary code in the application context, potentially leading to full system compromise and exposure of medical data. High risk for healthcare environments.

Recommendation

Update INFINITT PACS to a patched version or apply the vendor-recommended mitigation. Restrict network access to the system and block unexpected imodular:// URIs.

Other vulnerabilities in INFINITT PACS

CVE-2026-16305Unknown
Local privilege escalation in SmartUpdate.exe and SmartExecute.exe in INFINITT PACS. A local low-privileged attacker can modify the world-writable execlist.txt command manifest processed during application updates to execute arbitrary commands with administrator privileges.

Original NVD description (English source)

Remote Code Execution in the `IModular.exe` URI handler in INFINITT Healthcare Co., Ltd. INFINITT PACS allows a remote unauthenticated attacker to invoke unintended application functionality and potentially execute arbitrary code via a crafted `imodular:// URI` containing attacker-controlled command and argument parameters.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS