Wellbia XIGNCODE3 CVE-2026-3609

Exploitation requires local code execution as any logged-on user (CVSS PR:L, AV:L) on a Windows endpoint where the Wellbia XIGNCODE3 kernel driver xhunter1.sys is installed and currently loaded - typically a system running a XIGNCODE3-protected online game such that the driver's device object is reachable from user mode. No user interaction beyond the attacker's own process is needed (UI:N), and no special configuration of XIGNCODE3 is required - the IRP_MJ_REITS handler exposes the vulnerable behavior in the default deployment of the affected build (10.0.10011.16384). Limiting factors are the local-only attack surface (no remote vector), the requirement that the driver actually be loaded at exploitation time (game running or driver service active), and the relatively narrow installed base outside gaming systems.

Signals are mixed and lean toward moderate, targeted risk rather than mass-exploitation urgency. CVSS 7.8 with vector AV:L/AC:L/PR:L/UI:N reflects a reliable local elevation primitive once code is already running on the host, and SSVC corroborates this as POC-grade exploitation with partial technical impact and not automatable - consistent with a manual LPE rather than a worm-able RCE. EPSS at 0.02% (4th percentile) and absence from CISA KEV indicate no observed in-the-wild exploitation, which is plausible given the niche deployment footprint (gaming clients) and the local-only attack surface. The most important caveat: the technical impact under SSVC is rated 'partial', yet the described primitive (PROCESS_ALL_ACCESS to any process) effectively yields SYSTEM via LSASS or other privileged target processes, so defenders should treat real-world technical impact as closer to total on endpoints where the driver is loaded. CWE is unassigned, which slightly weakens automated triage but does not change the practical picture.

An attacker with code execution as a standard user on a Windows host that has a XIGNCODE3-protected game installed opens a handle to the xhunter1.sys device and issues the IRP_MJ_REITS request targeting lsass.exe, receiving a PROCESS_ALL_ACCESS handle. Using that handle the attacker dumps credentials or injects a SYSTEM-level payload, completing local privilege escalation from a low-integrity foothold (for example, a phishing-delivered loader or a malicious game mod) to full host compromise. A public proof-of-concept write-up is available at blacksnufkin.github.io, so weaponization effort is low for a skilled adversary.