CVE-2026-16305 Details
Description
Local privilege escalation in `SmartUpdate.exe` and `SmartExecute.exe` in INFINITT Healthcare Co., Ltd. INFINITT PACS allows a local low-privileged attacker to execute arbitrary commands with administrator privileges via modification of a world-writable `execlist.txt` command manifest that is processed during application updates.
A local privilege escalation vulnerability has been identified in 'SmartUpdate.exe' and 'SmartExecute.exe' within INFINITT Healthcare's INFINITT PACS. This vulnerability allows a low-privileged attacker to execute arbitrary commands with administrator rights. The issue arises from the ability to modify a world-writable 'execlist.txt' command manifest, which is processed during application updates.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Nov 2, 2026CISA-ADP
Assessed Nov 6, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://www.infinittna.com/ | [email protected] | Vendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-269 | Improper Privilege Management | CISA-ADP |
| CWE-276 | Incorrect Default Permissions | CISA-ADP |
| CWE-732 | Incorrect Permission Assignment for Critical Resource | CISA-ADP |
Affected Products
| Product | Versions |
|---|---|
| INFINITT Healthcare INFINITT PACS | All versions |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Nov 6, 2026 | CVE Modified | CISA-ADP |
| Nov 2, 2026 | New CVE Received | [email protected] |