The flaw resides in Wellbia's XIGNCODE3 kernel driver, xhunter1.sys, which exposes the IRP_MJ_REITS control code to any user‑space process. By invoking this interface, an attacker can request PROCESS_ALL_ACCESS, a classic access‑control weakness. If granted, the process gains full kernel privileges, allowing the attacker to escape normal user isolation and perform privileged kernel operations. No additional compromises are required.

The affected product is Wellbia XIGNCODE3 Anti‑Cheat. No specific version range is supplied by the CNA, so every build that includes the vulnerable xhunter1.sys driver is potentially at risk. The provided CPE points to build 10.0.10011.16384, but the lack of explicit version constraints implies earlier releases may also contain the flaw.

The CVSS score of 5.3 indicates moderate severity, while the EPSS score is below 1 %, reflecting a low probability of exploitation. The vulnerability is not listed in the CISA KEV catalog. The attack vector inferred from the description is local: a user process can send the IRP to the driver, triggering privilege escalation. No remote exploitation path is described.