RCE via imodular:// URI handler in INFINITT PACS
The IModular.exe URI handler in INFINITT Healthcare's INFINITT PACS can be abused for remote code execution. A remote, unauthenticated attacker who supplies a crafted imodular:// URI with attacker-controlled command and argument parameters can invoke unintended application functionality and potentially run arbitrary code. Systems that register this handler are affected; affected builds are not listed.
What to do: Apply INFINITT Healthcare's update for CVE-2026-16306. No fixed version or workaround is listed.
| Product | Affected |
|---|---|
| INFINITT Healthcare Co., Ltd. INFINITT PACS | — |
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Remote Code Execution in the `IModular.exe` URI handler in INFINITT Healthcare Co., Ltd. INFINITT PACS allows a remote unauthenticated attacker to invoke unintended application functionality and potentially execute arbitrary code via a crafted `imodular:// URI` containing attacker-controlled command and argument parameters.
INFINITT PACS System Manager versions 3.0.11.3 and 3.0.11.5 contain multiple code execution vulnerabilities that may allow local and remote attackers to execute arbitrary code.
Today 1.5K readers · 2.4K views · 768 reads · all time 189K views