Vulnerability · Published May 11, 2026 · Assigned by certcc
CVE-2026-3609XIGNCODE3 xhunter1.sys kernel driver contains a Privilege Escalation Vulnerability
Medium 5.3
In plain English
A medium-severity security flaw in XIGNCODE3 from Wellbia. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 14% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code.
Official description
Wellbia's XIGNCODE3 xhunter1.sys kernel driver, version 10.0.10011.16384 through 2023.12.7.78, privilege escalation vulnerability provides access to the IRP_MJ_WRITE command interface, which allows any user process to request a PROCESS_ALL_ACCESS. Note: KVE 2023-5589 (https://krcert.or.kr) was initially issued for version 10.0.10011.16384, but the vulnerability was not fully remediated and remains in version 2023.12.7.78.