EUVD-2026-52326
GHSA-gmfc-jwm3-239r
Severity by source
AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Description confirms full SYSTEM-level code execution (I:H), credential extraction (C:H), and process termination (A:H); PR:N matches local unprivileged caller per description and original vector.
Primary rating from Vendor (certcc).
CVSS VectorVendor: certcc
Lifecycle Timeline
2DescriptionCVE.org
Improper access control in the IRP_MJ_WRITE command interface in Wellbia XIGNCODE3 xhunter2.sys, version 2026.6.1.192, allows a local, unprivileged attacker to achieve local privilege escalation to NT AUTHORITY\SYSTEM, extract credentials from PPL-protected lsass.exe, and terminate PPL-protected security processes.
AnalysisAI
Privilege escalation to NT AUTHORITY\SYSTEM is achievable by any local, unprivileged user via Wellbia XIGNCODE3's kernel driver xhunter2.sys version 2026.6.1.192, due to missing access control on the IRP_MJ_WRITE command interface. Beyond SYSTEM-level execution, the flaw enables extraction of credentials from PPL-protected lsass.exe and termination of PPL-protected security processes such as EDR/AV agents, effectively disabling host defenses. No active exploitation is confirmed by CISA KEV, though the primary reference is a researcher blog post (blacksnufkin's 'Hunting the Hunter II') that strongly suggests PoC-grade research material exists.
Technical ContextAI
XIGNCODE3 is a Windows kernel-mode anti-cheat solution deployed with online games, identified by CPE cpe:2.3:a:wellbia:xigncode3:*:*:*:*:*:*:*:*. Its driver, xhunter2.sys, registers an IRP_MJ_WRITE dispatch handler - the standard Windows Driver Model entry point for write I/O requests. CWE-284 (Improper Access Control) is the root cause: the driver fails to enforce any access control check on callers of this handler, meaning a DeviceIoControl or WriteFile call from any user-mode process - regardless of privilege level - is accepted and processed. Because the driver runs at kernel ring-0, processing an attacker-controlled write request can expose direct kernel object manipulation primitives. The PPL (Protected Process Light) bypass aspect is particularly notable: PPL was designed to prevent even SYSTEM-level processes from tampering with lsass and security software, but a kernel-level write primitive can circumvent this user/kernel boundary protection entirely.
RemediationAI
No vendor-released patch with an exact fixed version has been identified at time of analysis; the only references are the NVD entry and a third-party researcher blog post. Game publishers and system administrators should contact Wellbia directly for a patched xhunter2.sys build. As an immediate compensating control, uninstall or disable XIGNCODE3-protected titles on sensitive or shared-user systems until a patch is confirmed, noting that this will restrict access to affected games. If removal is not operationally feasible, restrict local interactive logon access to only trusted, minimally-necessary users using Group Policy (Deny log on locally / Deny log on through Remote Desktop Services) to reduce the pool of potential local attackers - this does not eliminate the vulnerability but raises the access bar. Additionally, monitor for unexpected lsass memory read attempts and sudden termination of PPL-protected security processes (Event ID 4689 with protected-process targets) as indicators of exploitation. Do NOT assume the absence of a vendor advisory means the issue is unconfirmed - it is documented by CERT/CC and ENISA EUVD.
Same weakness CWE-284 – Improper Access Control
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today