{"id":"CVE-2018-19320","kind":"vulnerability","aliases":["CVE-2018-19320"],"related":[],"title":"The GDrv low-level driver in GIGABYTE APP Center v1.05.21 and earlier, AORUS GRAPHICS ENGINE before 1.57, XTREME…","description":"The GDrv low-level driver in GIGABYTE App Center, AORUS Graphics Engine, XTREME Gaming Engine, and OC GURU II exposes ring0 memcpy-like functionality that could allow a local attacker to take complete control of the affected system.\n\nCISA required action: Apply updates per vendor instructions.","summary":"GIGABYTE's GDrv kernel driver, shipped with App Center, AORUS Graphics Engine, XTREME Gaming Engine and OC GURU II, exposes ring-0 memory copy functionality to user code. A local attacker can use it to take complete control of the Windows machine.","severity":"high","cvss":7.8,"epss":null,"exploited":true,"exploited_at":"2022-10-24T00:00:00+00:00","products":[{"name":"GIGABYTE Multiple Products","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"gigabyte aorus graphics engine","fixed":["1.57"],"affected":"< 1.57","ecosystem":"vendor"},{"name":"gigabyte app center","fixed":["19.0422.1"],"affected":"< 19.0422.1","ecosystem":"vendor"},{"name":"gigabyte oc guru ii","fixed":[],"affected":"= 2.08","ecosystem":"vendor"},{"name":"gigabyte xtreme gaming engine","fixed":["1.26"],"affected":"< 1.26","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["exploited","gigabyte","infrastructure","ransomware","windows","workstations"],"not_affected_if":["no-gigabyte-utilities-installed"],"how_to_check":null,"fix":"Apply the vendor updates per GIGABYTE instructions, as CISA directs; the sources do not name the fixed versions.\nRemove the affected GIGABYTE utilities if they are not needed.","status":"open","published_at":"2018-12-21T23:29:00+00:00","first_seen_at":"2026-10-23T19:11:52+00:00","triaged_at":"2026-10-23T21:10:29+00:00","updated_at":"2026-10-23T22:29:04+00:00","category":"infrastructure","confidence":0.6,"triage":{"at":"2026-10-23T21:10:29Z","model":"claude-haiku-5-5","output":{"fix":"Apply the vendor updates per GIGABYTE instructions, as CISA directs; the sources do not name the fixed versions.\nRemove the affected GIGABYTE utilities if they are not needed.","reach":"local","impact":"high","summary":"GIGABYTE's GDrv kernel driver, shipped with App Center, AORUS Graphics Engine, XTREME Gaming Engine and OC GURU II, exposes ring-0 memory copy functionality to user code. A local attacker can use it to take complete control of the Windows machine.","category":"infrastructure","who_cares":["windows","gigabyte","workstations"],"confidence":0.6,"needs_auth":"yes","worst_case":"local user gains kernel-level control of the whole system","analyst_note":"Find the fixed GDrv driver versions and the vendor advisory from the CISA KEV entry or GIGABYTE's security page, and confirm how to detect the driver file (e.g. GDrv.sys) on disk.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["no-gigabyte-utilities-installed"],"user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"high"},"cost_usd":0.000494,"input_tokens":2844,"output_tokens":420,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-0':71B '-19320':22A,25A '-2018':21A,24A '1.57':18A 'action':134C 'affect':130C 'allow':120C 'aorus':14A,30A,59B,102C 'app':9A,34A,57B,100C 'appli':135C 'attack':80B,123C 'center':10A,35A,58B,101C 'cisa':132C 'code':77B 'complet':86B,126C 'control':87B,127C 'copi':73B 'could':119C 'cve':20A,23A 'driver':6A,54B,97C 'earlier':13A 'engin':16A,61B,64B,104C,107C 'engine':32A,43A 'exploit':44B 'expos':69B,112C 'function':74B,117C 'game':63B,106C 'gaming':42A 'gdrv':2A,52B,93C 'gigabyt':8A,45B,50B,99C 'gigabyte':26A,29A,33A,36A,40A 'graphic':15A,60B,103C 'graphics':31A 'guru':38A,67B,110C 'ii':39A,68B,111C 'infrastructur':46B 'instruct':139C 'kernel':53B 'level':5A,96C 'like':116C 'local':79B,122C 'low':4A,95C 'low-level':3A,94C 'machin':91B 'memcpi':115C 'memcpy-lik':114C 'memori':72B 'multiple':27A 'oc':37A,66B,109C 'per':137C 'products':28A 'ransomwar':47B 'requir':133C 'ring':70B 'ring0':113C 'ship':55B 'system':131C 'take':85B,125C 'updat':136C 'use':82B 'user':76B 'v1.05.21':11A 'vendor':138C 'window':48B,90B 'workstat':49B 'xtreme':19A,41A,62B,105C","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2018-12-21T23:29:00+00:00","kev":{"dateAdded":"2022-10-24","dueDate":"2022-11-14","requiredAction":"Apply updates per vendor instructions.","knownRansomwareCampaignUse":"Known"},"cvss_vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cvss_by":"nvd@nist.gov","poc_count":0,"sources":[{"source":"kev","external_id":"CVE-2018-19320","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2018-19320","severity":null,"published_at":"2022-10-24T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-10-23T19:11:52+00:00","fetched_at":"2026-10-25T19:35:23+00:00","note":null},{"source":"nvd","external_id":"CVE-2018-19320","url":"https://nvd.nist.gov/vuln/detail/CVE-2018-19320","severity":null,"published_at":"2018-12-21T23:29:00+00:00","modified_at":"2026-08-13T05:17:16+00:00","first_seen_at":"2026-10-23T22:29:04+00:00","fetched_at":"2026-10-23T22:29:04+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}