CVE-2026-3609

Wellbia's XIGNCODE3 xhunter1.sys kernel driver, version 10.0.10011.16384 through 2023.12.7.78, privilege escalation vulnerability provides access to the IRP_MJ_WRITE command interface, which allows any user process to request a PROCESS_ALL_ACCESS. Note: KVE 2023-5589 (https://krcert.or.kr) was initially issued for version 10.0.10011.16384, but the vulnerability was not fully remediated and remains in version 2023.12.7.78.

CVSS v3.1

7.8 HIGHCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CVSS v3.1

5.3 MEDIUMCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

EPSS

0.23% chance of exploitation in the next 30 days, 14th percentile

Published

2026-05-11

Updated

2026-08-05

Proof-of-concept exploits (2)

• BlackSnufkin/CredsHunter37★ · 2026-05-12
• BlackSnufkin/AxHunter12★ · 2026-08-07

References

• CVE Record
• NVD entry

Related

• CVE-2026-15430
• CVE-2026-8501
• CVE-2026-3607
• CVE-2026-3610
• CVE-2026-3606
• CVE-2026-3612