XIGNCODE3 EUVD-2026-52326

The XIGNCODE3 xhunter2.sys driver must be installed and loaded on the target Windows system, which requires the target to have an XIGNCODE3-protected game installed. The attacker requires only local interactive or remote desktop session access as any non-privileged user; the CVSS vector AV:L/AC:L/PR:N/UI:N confirms no authentication privileges are required beyond a local session. No non-default configuration is necessary - the vulnerable IRP_MJ_WRITE handler is exposed by default when the driver is loaded. Exploitation is limited to Windows systems only (kernel driver), and the 'Automatable: no' SSVC designation indicates the attack cannot be reliably scripted across diverse targets without human interaction or targeting. The main limiting factor is the AV:L constraint: remote, unauthenticated exploitation is not possible; the attacker must already have a local session on the targeted host.

The provided CVSS score of 6.2 with vector AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N significantly understates the real-world impact: the description explicitly describes Integrity and Availability impacts (SYSTEM-level code execution and process termination) that are absent from the official vector, suggesting the score was scored only against the credential-reading primitive and not the full attack surface. The SSVC assessment of Technical Impact: partial conflicts with the description's mention of full SYSTEM access and PPL bypass, which would typically indicate total technical impact. EPSS data is not provided, and SSVC exploitation status is 'none', consistent with no KEV listing. However, the reference to a published research post ('Hunting the Hunter II') suggests exploit code or a detailed technical write-up exists publicly, which historically accelerates exploitation timelines. The local-only vector (AV:L) and 'Automatable: no' SSVC designation limit mass exploitation potential, but on any system running an XIGNCODE3-protected game, any local user can achieve SYSTEM and disable defensive tooling - a critical threat in shared or multi-user Windows environments and a post-exploitation enabler on already-compromised endpoints.

A standard user account on a Windows gaming PC - including a restricted guest account or a threat actor who has gained limited initial foothold - opens a handle to the xhunter2.sys device and issues a crafted IRP_MJ_WRITE request that the driver processes without verifying caller privileges, yielding a kernel-level write primitive. The attacker leverages this primitive to elevate their process token to NT AUTHORITY\SYSTEM and subsequently reads credential material from lsass.exe memory (bypassing PPL protection) or terminates the PPL-protected EDR agent to blind the host before proceeding with lateral movement. The researcher blog post 'Hunting the Hunter II' likely contains technical detail sufficient to replicate this chain.