Live › vulnerability › CVE-2018-19321
Go to dashboardGIGABYTE's GPCIDrv and GDrv kernel drivers, shipped with App Center, AORUS Graphics Engine, XTREME Gaming Engine and OC GURU II, let any process read and write arbitrary physical memory. A local attacker can use this to gain higher privileges, and CISA lists it as actively exploited, including in ransomware campaigns.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 19:11 UTC, 3h before NVD. All times on this page are UTC.
Apply updates per vendor instructions.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| GIGABYTE Multiple Products | vendor | – | – |
| gigabyte aorus graphics engine | vendor | < 1.57 | 1.57 |
| gigabyte app center | vendor | < 19.0422.1 | 19.0422.1 |
| gigabyte oc guru ii | vendor | = 2.08 | – |
| gigabyte xtreme gaming engine | vendor | < 1.26 | 1.26 |
Look for GPCIDrv.sys or GDrv.sys under the Windows driver store or system32/drivers, and check whether GIGABYTE App Center or the other listed utilities are installed.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
The GPCIDrv and GDrv low-level drivers in GIGABYTE App Center, AORUS Graphics Engine, XTREME Gaming Engine, and OC GURU II expose functionality to read and write arbitrary physical memory. This could be leveraged by a local attacker to elevate privileges.
CISA required action: Apply updates per vendor instructions.
This page as .md · .json · in your agent: get_signal("CVE-2018-19321")
CISA KEV catalog, Creative Commons 0 · NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.