CVE-2026-3609

CVE-2026-3609

High · published May 11, 2026

CVSS v3.1
7.8
EPSS
0%
Percentile
5.3
In the wild
Unconfirmed
What it is

Wellbia's XIGNCODE3 xhunter1.sys kernel driver, version 10.0.10011.16384 through 2023.12.7.78, privilege escalation vulnerability provides access to the IRP_MJ_WRITE command interface, which allows any user process to request a PROCESS_ALL_ACCESS.

Note: KVE 2023-5589 (https://krcert.or.kr) was initially issued for version 10.0.10011.16384, but the vulnerability was not fully remediated and remains in version 2023.12.7.78.

The record
Technical detail
CVSS v3.1
7.8 · HIGH
Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00164 · 5.3th percentile
Published
2026-05-11T22:16Z
Affected products (1)
ProductVersionsFixed in
wellbia/xigncode3all versions—
References (4)
https://blacksnufkin.github.io/posts/AntiCheat-LPE-CVE-2026-3609/ · [email protected]https://blacksnufkin.github.io/posts/Hunting-the-Hunter/ · [email protected]https://crcert.or.kr · [email protected]https://blacksnufkin.github.io/posts/AntiCheat-LPE-CVE-2026-3609/ · 134c704f-9b21-4f2e-91b3-4a467353bcc0
EPSS history
Timeline
  • 11 MAY 16:25Z
    XIGNCODE3 xhunter1.sys kernel driver contains a Privilege Escalation Vulnerability
    cvelistv5