---
id: CVE-2026-16305
title: CVE-2026-16305
summary: >-
  Local privilege escalation in `SmartUpdate.exe` and `SmartExecute.exe` in
  INFINITT Healthcare Co., Ltd. INFINITT PACS allows a local low-privileged
  attacker to execute arbitrary commands with administrator privileges via
  modification of …
severity: none
cwe:
  - CWE-732
  - CWE-276
  - CWE-269
vendor: INFINITT Healthcare
product: System Manager
affected:
  - system_manager >= 3.0.11.3 <= 3.0.11.5
published: '2026-11-02'
updated: '2026-11-02'
sourceUpdated: '2026-11-02T20:13:26.876Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-16305'
references:
  - url: 'https://www.infinittna.com/'
tags:
  - cve.org
epss: 0.00259
epssPercentile: 0.17765
ingestedAt: '2026-11-05T19:30:42.826Z'
---

## Overview

Local privilege escalation in `SmartUpdate.exe` and `SmartExecute.exe` in INFINITT Healthcare Co., Ltd. INFINITT PACS allows a local low-privileged attacker to execute arbitrary commands with administrator privileges via modification of a world-writable `execlist.txt` command manifest that is processed during application updates.

## Affected

- `system_manager >= 3.0.11.3 <= 3.0.11.5`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.