---
id: "CVE-2018-19321"
kind: "vulnerability"
aliases: ["CVE-2018-19321"]
title: "The GPCIDrv and GDrv low-level drivers in GIGABYTE APP Center v1.05.21 and earlier, AORUS GRAPHICS ENGINE before\u2026"
severity: "high"
cvss: 7.8
epss: null
exploited: true
status: "open"
category: "infrastructure"
products: [{"name": "GIGABYTE Multiple Products", "fixed": [], "affected": "", "ecosystem": "vendor"}, {"name": "gigabyte aorus graphics engine", "fixed": ["1.57"], "affected": "< 1.57", "ecosystem": "vendor"}, {"name": "gigabyte app center", "fixed": ["19.0422.1"], "affected": "< 19.0422.1", "ecosystem": "vendor"}, {"name": "gigabyte oc guru ii", "fixed": [], "affected": "= 2.08", "ecosystem": "vendor"}, {"name": "gigabyte xtreme gaming engine", "fixed": ["1.26"], "affected": "< 1.26", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["exploited", "gigabyte", "infrastructure", "local-admin-workstations", "ransomware", "windows"]
not_affected_if: ["no-gigabyte-utilities-installed", "non-gigabyte-hardware"]
published_at: "2018-12-21T23:29:00+00:00"
first_seen_at: "2026-10-23T19:11:52+00:00"
updated_at: "2026-10-23T22:29:04+00:00"
sources: [{"source": "kev", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2018-19321", "first_seen_at": "2026-10-23T19:11:52+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-19321", "first_seen_at": "2026-10-23T22:29:04+00:00"}]
---

# The GPCIDrv and GDrv low-level drivers in GIGABYTE APP Center v1.05.21 and earlier, AORUS GRAPHICS ENGINE before…

GIGABYTE's GPCIDrv and GDrv kernel drivers, shipped with App Center, AORUS Graphics Engine, XTREME Gaming Engine and OC GURU II, let any process read and write arbitrary physical memory. A local attacker can use this to gain higher privileges, and CISA lists it as actively exploited, including in ransomware campaigns.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:GIGABYTE Multiple Products affected ? fixed ?
- vendor:gigabyte aorus graphics engine affected < 1.57 fixed 1.57
- vendor:gigabyte app center affected < 19.0422.1 fixed 19.0422.1
- vendor:gigabyte oc guru ii affected = 2.08 fixed ?
- vendor:gigabyte xtreme gaming engine affected < 1.26 fixed 1.26

## How to check

Look for GPCIDrv.sys or GDrv.sys under the Windows driver store or system32/drivers, and check whether GIGABYTE App Center or the other listed utilities are installed.

## Fix

Remove the listed GIGABYTE utilities or update them to a fixed build per vendor instructions; fixed versions are not named in the sources.
Block or remove the vulnerable driver files if the utilities are not needed.

## Timeline

- 2026-10-23T19:11:52+00:00 kev https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2018-19321
- 2026-10-23T22:29:04+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2018-19321

## From the sources

The GPCIDrv and GDrv low-level drivers in GIGABYTE App Center, AORUS Graphics Engine, XTREME Gaming Engine, and OC GURU II expose functionality to read and write arbitrary physical memory. This could be leveraged by a local attacker to elevate privileges.

CISA required action: Apply updates per vendor instructions.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_