{"id":"CVE-2018-19321","kind":"vulnerability","aliases":["CVE-2018-19321"],"related":[],"title":"The GPCIDrv and GDrv low-level drivers in GIGABYTE APP Center v1.05.21 and earlier, AORUS GRAPHICS ENGINE before…","description":"The GPCIDrv and GDrv low-level drivers in GIGABYTE App Center, AORUS Graphics Engine, XTREME Gaming Engine, and OC GURU II expose functionality to read and write arbitrary physical memory. This could be leveraged by a local attacker to elevate privileges.\n\nCISA required action: Apply updates per vendor instructions.","summary":"GIGABYTE's GPCIDrv and GDrv kernel drivers, shipped with App Center, AORUS Graphics Engine, XTREME Gaming Engine and OC GURU II, let any process read and write arbitrary physical memory. A local attacker can use this to gain higher privileges, and CISA lists it as actively exploited, including in ransomware campaigns.","severity":"high","cvss":7.8,"epss":null,"exploited":true,"exploited_at":"2022-10-24T00:00:00+00:00","products":[{"name":"GIGABYTE Multiple Products","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"gigabyte aorus graphics engine","fixed":["1.57"],"affected":"< 1.57","ecosystem":"vendor"},{"name":"gigabyte app center","fixed":["19.0422.1"],"affected":"< 19.0422.1","ecosystem":"vendor"},{"name":"gigabyte oc guru ii","fixed":[],"affected":"= 2.08","ecosystem":"vendor"},{"name":"gigabyte xtreme gaming engine","fixed":["1.26"],"affected":"< 1.26","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["exploited","gigabyte","infrastructure","local-admin-workstations","ransomware","windows"],"not_affected_if":["no-gigabyte-utilities-installed","non-gigabyte-hardware"],"how_to_check":"Look for GPCIDrv.sys or GDrv.sys under the Windows driver store or system32/drivers, and check whether GIGABYTE App Center or the other listed utilities are installed.","fix":"Remove the listed GIGABYTE utilities or update them to a fixed build per vendor instructions; fixed versions are not named in the sources.\nBlock or remove the vulnerable driver files if the utilities are not needed.","status":"open","published_at":"2018-12-21T23:29:00+00:00","first_seen_at":"2026-10-23T19:11:52+00:00","triaged_at":"2026-10-23T21:10:26+00:00","updated_at":"2026-10-23T22:29:04+00:00","category":"infrastructure","confidence":0.7,"triage":{"at":"2026-10-23T21:10:26Z","model":"claude-haiku-5-5","output":{"fix":"Remove the listed GIGABYTE utilities or update them to a fixed build per vendor instructions; fixed versions are not named in the sources.\nBlock or remove the vulnerable driver files if the utilities are not needed.","reach":"local","impact":"high","summary":"GIGABYTE's GPCIDrv and GDrv kernel drivers, shipped with App Center, AORUS Graphics Engine, XTREME Gaming Engine and OC GURU II, let any process read and write arbitrary physical memory. A local attacker can use this to gain higher privileges, and CISA lists it as actively exploited, including in ransomware campaigns.","category":"infrastructure","who_cares":["windows","gigabyte","local-admin-workstations"],"confidence":0.7,"needs_auth":"yes","worst_case":"local user escalates to kernel-level control via physical memory access","analyst_note":"Confirm the fixed driver and app versions from the GIGABYTE advisory and the CISA KEV entry; the sources give no version numbers.","how_to_check":"Look for GPCIDrv.sys or GDrv.sys under the Windows driver store or system32/drivers, and check whether GIGABYTE App Center or the other listed utilities are installed.\nunknown","needs_analyst":true,"not_affected_if":["no-gigabyte-utilities-installed","non-gigabyte-hardware"],"user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"high"},"cost_usd":0.000543,"input_tokens":2860,"output_tokens":513,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-19321':21A,24A '-2018':20A,23A 'action':147C 'activ':97B 'admin':48B 'aorus':16A,29A,63B,115C 'app':11A,33A,61B,113C 'appli':148C 'arbitrari':79B,131C 'attack':84B,141C 'campaign':102B 'center':12A,34A,62B,114C 'cisa':93B,145C 'could':135C 'cve':19A,22A 'driver':8A,58B,110C 'earlier':15A 'elev':143C 'engin':18A,65B,68B,117C,120C 'engine':31A,42A 'exploit':43B,98B 'expos':125C 'function':126C 'gain':89B 'game':67B,119C 'gaming':41A 'gdrv':4A,56B,106C 'gigabyt':10A,44B,52B,112C 'gigabyte':25A,28A,32A,35A,39A 'gpcidrv':2A,54B,104C 'graphic':17A,64B,116C 'graphics':30A 'guru':37A,71B,123C 'higher':90B 'ii':38A,72B,124C 'includ':99B 'infrastructur':45B 'instruct':152C 'kernel':57B 'let':73B 'level':7A,109C 'leverag':137C 'list':94B 'local':47B,83B,140C 'local-admin-workst':46B 'low':6A,108C 'low-level':5A,107C 'memori':81B,133C 'multiple':26A 'oc':36A,70B,122C 'per':150C 'physic':80B,132C 'privileg':91B,144C 'process':75B 'products':27A 'ransomwar':50B,101B 'read':76B,128C 'requir':146C 'ship':59B 'updat':149C 'use':86B 'v1.05.21':13A 'vendor':151C 'window':51B 'workstat':49B 'write':78B,130C 'xtreme':40A,66B,118C","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2018-12-21T23:29:00+00:00","kev":{"dateAdded":"2022-10-24","dueDate":"2022-11-14","requiredAction":"Apply updates per vendor instructions.","knownRansomwareCampaignUse":"Known"},"cvss_vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cvss_by":"nvd@nist.gov","poc_count":0,"sources":[{"source":"kev","external_id":"CVE-2018-19321","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2018-19321","severity":null,"published_at":"2022-10-24T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-10-23T19:11:52+00:00","fetched_at":"2026-10-25T12:39:23+00:00","note":null},{"source":"nvd","external_id":"CVE-2018-19321","url":"https://nvd.nist.gov/vuln/detail/CVE-2018-19321","severity":null,"published_at":"2018-12-21T23:29:00+00:00","modified_at":"2026-08-13T05:17:16+00:00","first_seen_at":"2026-10-23T22:29:04+00:00","fetched_at":"2026-10-23T22:29:04+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}