CVE-2026-16305: Security vulnerability

Published Nov 2, 2026

Updated

Local privilege escalation in SmartUpdate.exe and SmartExecute.exe in INFINITT Healthcare Co., Ltd. INFINITT PACS allows a local low-privileged attacker to execute arbitrary commands with administrator privileges via modification of a world-writable execlist.txt command manifest that is processed during application updates.

Event History

Nov 2, 2026

CVE Published

via NVD·09:17 PM

Data Sourced

via NVD·09:17 PM

Description

Frequently Asked Questions

Who can exploit this issue?

A local attacker with low privileges on a system running INFINITT PACS can exploit it if they can modify the world-writable execlist.txt manifest.

What access does an attacker need?

The attacker needs local access and a low-privileged account. No remote access requirement is described.

When does the privilege escalation occur?

The modified command manifest is processed during application updates, causing arbitrary commands to run with administrator privileges.

How can administrators assess exposure?

Administrators can check whether execlist.txt is world-writable and whether SmartUpdate.exe or SmartExecute.exe processes it during INFINITT PACS updates.

CVE-2026-16305: Security vulnerability

Event History

Frequently Asked Questions

Who can exploit this issue?

What access does an attacker need?

When does the privilege escalation occur?

How can administrators assess exposure?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this issue?

What access does an attacker need?

When does the privilege escalation occur?

How can administrators assess exposure?