{"id":"CVE-2018-19322","kind":"vulnerability","aliases":["CVE-2018-19322"],"related":[],"title":"The GPCIDrv and GDrv low-level drivers in GIGABYTE APP Center v1.05.21 and earlier, AORUS GRAPHICS ENGINE before…","description":"The GPCIDrv and GDrv low-level drivers in GIGABYTE App Center, AORUS Graphics Engine, XTREME Gaming Engine, and OC GURU II expose functionality to read/write data from/to IO ports. This could be leveraged in a number of ways to ultimately run code with elevated privileges.\n\nCISA required action: Apply updates per vendor instructions.","summary":"GIGABYTE's GPCIDrv and GDrv kernel drivers, shipped with App Center, AORUS Graphics Engine, XTREME Gaming Engine and OC GURU II, let user-level code read and write IO ports. An attacker with local access can use this to run code with elevated privileges, and CISA reports it is exploited in the wild, including in ransomware campaigns.","severity":"high","cvss":7.8,"epss":null,"exploited":true,"exploited_at":"2022-10-24T00:00:00+00:00","products":[{"name":"GIGABYTE Multiple Products","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"gigabyte aorus graphics engine","fixed":["1.57"],"affected":"< 1.57","ecosystem":"vendor"},{"name":"gigabyte app center","fixed":[],"affected":"<= 1.05.21","ecosystem":"vendor"},{"name":"gigabyte oc guru ii","fixed":[],"affected":"= 2.08","ecosystem":"vendor"},{"name":"gigabyte xtreme gaming engine","fixed":["1.26"],"affected":"< 1.26","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["exploited","gaming-pc","gigabyte","infrastructure","ransomware","windows","workstation"],"not_affected_if":["no-gigabyte-software-installed","non-windows"],"how_to_check":"Check whether GPCIDrv.sys or GDrv.sys exists on Windows machines, for example with: dir C:\\Windows\\System32\\drivers\\GPCIDrv.sys C:\\Windows\\System32\\drivers\\GDrv.sys\nCheck whether GIGABYTE App Center, AORUS Graphics Engine, XTREME Gaming Engine or OC GURU II is installed.","fix":"Apply the vendor update for the GIGABYTE utility, or uninstall App Center, AORUS Graphics Engine, XTREME Gaming Engine and OC GURU II if they are not needed. Specific fixed versions: unknown.","status":"open","published_at":"2018-12-21T23:29:00+00:00","first_seen_at":"2026-10-23T19:11:52+00:00","triaged_at":"2026-10-23T21:10:27+00:00","updated_at":"2026-10-23T22:29:04+00:00","category":"infrastructure","confidence":0.7,"triage":{"at":"2026-10-23T21:10:27Z","model":"claude-haiku-5-5","output":{"fix":"Apply the vendor update for the GIGABYTE utility, or uninstall App Center, AORUS Graphics Engine, XTREME Gaming Engine and OC GURU II if they are not needed. Specific fixed versions: unknown.","reach":"local","impact":"high","summary":"GIGABYTE's GPCIDrv and GDrv kernel drivers, shipped with App Center, AORUS Graphics Engine, XTREME Gaming Engine and OC GURU II, let user-level code read and write IO ports. An attacker with local access can use this to run code with elevated privileges, and CISA reports it is exploited in the wild, including in ransomware campaigns.","category":"infrastructure","who_cares":["windows","gigabyte","gaming-pc","workstation"],"confidence":0.7,"needs_auth":"yes","worst_case":"Local attacker gains elevated privileges and runs code as administrator or SYSTEM.","analyst_note":"Confirm affected and fixed versions per product and whether the drivers are removed on uninstall; source gives only 'apply vendor updates' (see CISA KEV entry and GIGABYTE advisory).","how_to_check":"Check whether GPCIDrv.sys or GDrv.sys exists on Windows machines, for example with: dir C:\\Windows\\System32\\drivers\\GPCIDrv.sys C:\\Windows\\System32\\drivers\\GDrv.sys\nCheck whether GIGABYTE App Center, AORUS Graphics Engine, XTREME Gaming Engine or OC GURU II is installed.\nunknown","needs_analyst":true,"not_affected_if":["no-gigabyte-software-installed","non-windows"],"user_interaction":"no","needs_special_setup":"no","severity_if_unknown":"high"},"cost_usd":0.000598,"input_tokens":2863,"output_tokens":624,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-19322':21A,24A '-2018':20A,23A 'access':87B 'action':158C 'aorus':16A,29A,63B,122C 'app':11A,33A,61B,120C 'appli':159C 'attack':84B 'campaign':109B 'center':12A,34A,62B,121C 'cisa':98B,156C 'code':77B,93B,152C 'could':141C 'cve':19A,22A 'data':136C 'driver':8A,58B,117C 'earlier':15A 'elev':95B,154C 'engin':18A,65B,68B,124C,127C 'engine':31A,42A 'exploit':43B,102B 'expos':132C 'from/to':137C 'function':133C 'game':45B,67B,126C 'gaming':41A 'gaming-pc':44B 'gdrv':4A,56B,113C 'gigabyt':10A,47B,52B,119C 'gigabyte':25A,28A,32A,35A,39A 'gpcidrv':2A,54B,111C 'graphic':17A,64B,123C 'graphics':30A 'guru':37A,71B,130C 'ii':38A,72B,131C 'includ':106B 'infrastructur':48B 'instruct':163C 'io':81B,138C 'kernel':57B 'let':73B 'level':7A,76B,116C 'leverag':143C 'local':86B 'low':6A,115C 'low-level':5A,114C 'multiple':26A 'number':146C 'oc':36A,70B,129C 'pc':46B 'per':161C 'port':82B,139C 'privileg':96B,155C 'products':27A 'ransomwar':49B,108B 'read':78B 'read/write':135C 'report':99B 'requir':157C 'run':92B,151C 'ship':59B 'ultim':150C 'updat':160C 'use':89B 'user':75B 'user-level':74B 'v1.05.21':13A 'vendor':162C 'way':148C 'wild':105B 'window':50B 'workstat':51B 'write':80B 'xtreme':40A,66B,125C","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2018-12-21T23:29:00+00:00","kev":{"dateAdded":"2022-10-24","dueDate":"2022-11-14","requiredAction":"Apply updates per vendor instructions.","knownRansomwareCampaignUse":"Known"},"cvss_vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cvss_by":"nvd@nist.gov","poc_count":0,"sources":[{"source":"kev","external_id":"CVE-2018-19322","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2018-19322","severity":null,"published_at":"2022-10-24T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-10-23T19:11:52+00:00","fetched_at":"2026-10-25T10:39:06+00:00","note":null},{"source":"nvd","external_id":"CVE-2018-19322","url":"https://nvd.nist.gov/vuln/detail/CVE-2018-19322","severity":null,"published_at":"2018-12-21T23:29:00+00:00","modified_at":"2026-08-13T05:17:16+00:00","first_seen_at":"2026-10-23T22:29:04+00:00","fetched_at":"2026-10-23T22:29:04+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}