VU#203719: INFINITT PACS System Manager Contains Multiple Code Execution Vulnerabilities
2026-11-02T20:52:02Z•6a3491a31b912fc1b9ea0d6e5cd72140359d8094f75ff5c8c6bd7118bd96d077
CVE-2026-109618CVE-2026-109619CVE-2026-16305CVE-2026-16306CVE-2026-34073CVE-2026-3547CVE-2026-3833CVE-2026-91141CVE-2026-97406BoringSSLCERT/CCINFINITT PACSMPCName ConstraintsPHPTLSX.509Xerjarbitrary code executionauthentication bypassautomotivecredential persistencedenial of servicehealthcarememory corruptionmemory exhaustionmultiple vulnerabilitiesremote code executionuse-after-freevsomeipvulnerability retraction
What happened
CERT/CC advisories describe multiple 2026 vulnerabilities across healthcare PACS, automotive SOME/IP middleware, PHP, credential-management platforms, TLS/X.509 libraries, and other software. Notable issues include unauthenticated remote code execution in vulnerable PHP releases, unauthenticated memory-exhaustion denial of service in vsomeip, arbitrary code execution in INFINITT PACS System Manager, and authentication bypass enabling persistent credential minting in Xerj. Several TLS Name Constraints findings have mixed statuses, while VU#701544 was retracted as invalid.
Why it matters
A reviewed impact interpretation has not been published for this record.
Evidence and limitations
- Source ID
- certcc_vulnotes
- Record identifier
- 6a3491a31b912fc1b9ea0d6e5cd72140359d8094f75ff5c8c6bd7118bd96d077
- Enrichment time
- 2026-11-02T20:52:02Z
- AI-assisted enrichment
- Yes
This record may overlap with other records. Its enrichment can be incomplete or wrong, and machine assistance was used. Validate consequential decisions against the linked source and your own environment.