INFINITT PACS System Manager Flaws Allow Local Privilege Escalation and Code Execution

CERT/CC published advisory VU#203719 on November 2, 2026, describing two code execution vulnerabilities in INFINITT PACS System Manager versions 3.0.11.3 and 3.0.11.5. The first, CVE-2026-16305, stems from weak file permissions on execlist.txt, which a low-privileged local user could modify so that an approved update runs added commands with administrative privileges. The second, CVE-2026-16306, affects the imodular:// URI handler in IModular.exe, which executes commands from crafted links without validating them, letting an attacker run code with the user's privileges when a victim opens a malicious link. INFINITT Healthcare lists versions 3.0.12.3 and 3.0.12.5 as fixed. The advisory reports no evidence of exploitation, but administrators are advised to check versions, file permissions and URI handler registration on PACS workstations. Interim measures include restricting local logons and shared use, limiting reachable network shares and blocking malicious URI links where possible.