Search: CVE-2026-16306

CVE-2026-16306 is a remote code execution vulnerability in the IModular.exe URI handler of INFINITT Healthcare System Manager. An unauthenticated remote attacker can exploit this flaw by crafting a malicious imodular:// URI with attacker-controlled commands and arguments, potentially invoking unintended application functionality and executing arbitrary code. The vulnerability affects versions from 3.0.11.3 through 3.0.11.5 inclusive.

INFINITT PACS System Manager versions 3.0.11.3 and 3.0.11.5 contain multiple code execution vulnerabilities. CVE-2026-16305 allows a local low-privileged attacker to execute arbitrary commands with administrative privileges due to insecure file permissions on an update manifest file. CVE-2026-16306 allows remote code execution via a crafted imodular:// URI scheme that executes unsafe commands without proper validation. Both vulnerabilities have been fixed in versions 3.0.12.3 and 3.0.12.5.