Live › vulnerability › CVE-2018-19322
Go to dashboardGIGABYTE's GPCIDrv and GDrv kernel drivers, shipped with App Center, AORUS Graphics Engine, XTREME Gaming Engine and OC GURU II, let user-level code read and write IO ports. An attacker with local access can use this to run code with elevated privileges, and CISA reports it is exploited in the wild, including in ransomware campaigns.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 19:11 UTC, 3h before NVD. All times on this page are UTC.
Apply updates per vendor instructions.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| GIGABYTE Multiple Products | vendor | – | – |
| gigabyte aorus graphics engine | vendor | < 1.57 | 1.57 |
| gigabyte app center | vendor | <= 1.05.21 | – |
| gigabyte oc guru ii | vendor | = 2.08 | – |
| gigabyte xtreme gaming engine | vendor | < 1.26 | 1.26 |
Check whether GPCIDrv.sys or GDrv.sys exists on Windows machines, for example with: dir C:\Windows\System32\drivers\GPCIDrv.sys C:\Windows\System32\drivers\GDrv.sys Check whether GIGABYTE App Center, AORUS Graphics Engine, XTREME Gaming Engine or OC GURU II is installed.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
The GPCIDrv and GDrv low-level drivers in GIGABYTE App Center, AORUS Graphics Engine, XTREME Gaming Engine, and OC GURU II expose functionality to read/write data from/to IO ports. This could be leveraged in a number of ways to ultimately run code with elevated privileges.
CISA required action: Apply updates per vendor instructions.
This page as .md · .json · in your agent: get_signal("CVE-2018-19322")
CISA KEV catalog, Creative Commons 0 · NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.