---
id: "CVE-2018-19320"
kind: "vulnerability"
aliases: ["CVE-2018-19320"]
title: "The GDrv low-level driver in GIGABYTE APP Center v1.05.21 and earlier, AORUS GRAPHICS ENGINE before 1.57, XTREME\u2026"
severity: "high"
cvss: 7.8
epss: null
exploited: true
status: "open"
category: "infrastructure"
products: [{"name": "GIGABYTE Multiple Products", "fixed": [], "affected": "", "ecosystem": "vendor"}, {"name": "gigabyte aorus graphics engine", "fixed": ["1.57"], "affected": "< 1.57", "ecosystem": "vendor"}, {"name": "gigabyte app center", "fixed": ["19.0422.1"], "affected": "< 19.0422.1", "ecosystem": "vendor"}, {"name": "gigabyte oc guru ii", "fixed": [], "affected": "= 2.08", "ecosystem": "vendor"}, {"name": "gigabyte xtreme gaming engine", "fixed": ["1.26"], "affected": "< 1.26", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["exploited", "gigabyte", "infrastructure", "ransomware", "windows", "workstations"]
not_affected_if: ["no-gigabyte-utilities-installed"]
published_at: "2018-12-21T23:29:00+00:00"
first_seen_at: "2026-10-23T19:11:52+00:00"
updated_at: "2026-10-23T22:29:04+00:00"
sources: [{"source": "kev", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2018-19320", "first_seen_at": "2026-10-23T19:11:52+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-19320", "first_seen_at": "2026-10-23T22:29:04+00:00"}]
---

# The GDrv low-level driver in GIGABYTE APP Center v1.05.21 and earlier, AORUS GRAPHICS ENGINE before 1.57, XTREME…

GIGABYTE's GDrv kernel driver, shipped with App Center, AORUS Graphics Engine, XTREME Gaming Engine and OC GURU II, exposes ring-0 memory copy functionality to user code. A local attacker can use it to take complete control of the Windows machine.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:GIGABYTE Multiple Products affected ? fixed ?
- vendor:gigabyte aorus graphics engine affected < 1.57 fixed 1.57
- vendor:gigabyte app center affected < 19.0422.1 fixed 19.0422.1
- vendor:gigabyte oc guru ii affected = 2.08 fixed ?
- vendor:gigabyte xtreme gaming engine affected < 1.26 fixed 1.26

## Fix

Apply the vendor updates per GIGABYTE instructions, as CISA directs; the sources do not name the fixed versions.
Remove the affected GIGABYTE utilities if they are not needed.

## Timeline

- 2026-10-23T19:11:52+00:00 kev https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2018-19320
- 2026-10-23T22:29:04+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2018-19320

## From the sources

The GDrv low-level driver in GIGABYTE App Center, AORUS Graphics Engine, XTREME Gaming Engine, and OC GURU II exposes ring0 memcpy-like functionality that could allow a local attacker to take complete control of the affected system.

CISA required action: Apply updates per vendor instructions.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_