Skip to content
OpenAdvisories
Medium · 5.3 Public exploit CVE-2026-3609 EUVD-2026-29110GHSA-4gcg-jv45-v47x

XIGNCODE3 xhunter1.sys kernel driver contains a Privilege Escalation Vulnerability

Published May 11, 2026 · Updated Aug 5, 2026 · Assigned by certcc

Vendor: Wellbia Product: XIGNCODE3

Description

Wellbia's XIGNCODE3 xhunter1.sys kernel driver, version 10.0.10011.16384 through 2023.12.7.78, privilege escalation vulnerability provides access to the IRP_MJ_WRITE command interface, which allows any user process to request a PROCESS_ALL_ACCESS.

Note: KVE 2023-5589 (https://krcert.or.kr) was initially issued for version 10.0.10011.16384, but the vulnerability was not fully remediated and remains in version 2023.12.7.78.

Affected products

VendorProductAffectedFixed
Wellbia XIGNCODE3 10.0.10011.16384 – ≤ 2023.12.7.78 —

Public exploits

Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.

Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.

GitHub 2 repositories

  • BlackSnufkin/BYOVD ★ 1,023 · Dec 5, 2023

    BYOVD research use cases featuring vulnerable driver discovery and reverse engineering methodology. (CVE-2025-52915, CVE-2025-1055, CVE-2026-3609, CVE-2026-8501).

  • BlackSnufkin/CredsHunter ★ 39 · May 12, 2026

    PoC for CVE-2026-3609 - XIGNCODE3 xhunter1.sys handle leak enabling PPL bypass and LSASS dumping

Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.

References