---
id: "CVE-2018-19322"
kind: "vulnerability"
aliases: ["CVE-2018-19322"]
title: "The GPCIDrv and GDrv low-level drivers in GIGABYTE APP Center v1.05.21 and earlier, AORUS GRAPHICS ENGINE before\u2026"
severity: "high"
cvss: 7.8
epss: null
exploited: true
status: "open"
category: "infrastructure"
products: [{"name": "GIGABYTE Multiple Products", "fixed": [], "affected": "", "ecosystem": "vendor"}, {"name": "gigabyte aorus graphics engine", "fixed": ["1.57"], "affected": "< 1.57", "ecosystem": "vendor"}, {"name": "gigabyte app center", "fixed": [], "affected": "<= 1.05.21", "ecosystem": "vendor"}, {"name": "gigabyte oc guru ii", "fixed": [], "affected": "= 2.08", "ecosystem": "vendor"}, {"name": "gigabyte xtreme gaming engine", "fixed": ["1.26"], "affected": "< 1.26", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["exploited", "gaming-pc", "gigabyte", "infrastructure", "ransomware", "windows", "workstation"]
not_affected_if: ["no-gigabyte-software-installed", "non-windows"]
published_at: "2018-12-21T23:29:00+00:00"
first_seen_at: "2026-10-23T19:11:52+00:00"
updated_at: "2026-10-23T22:29:04+00:00"
sources: [{"source": "kev", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2018-19322", "first_seen_at": "2026-10-23T19:11:52+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-19322", "first_seen_at": "2026-10-23T22:29:04+00:00"}]
---

# The GPCIDrv and GDrv low-level drivers in GIGABYTE APP Center v1.05.21 and earlier, AORUS GRAPHICS ENGINE before…

GIGABYTE's GPCIDrv and GDrv kernel drivers, shipped with App Center, AORUS Graphics Engine, XTREME Gaming Engine and OC GURU II, let user-level code read and write IO ports. An attacker with local access can use this to run code with elevated privileges, and CISA reports it is exploited in the wild, including in ransomware campaigns.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:GIGABYTE Multiple Products affected ? fixed ?
- vendor:gigabyte aorus graphics engine affected < 1.57 fixed 1.57
- vendor:gigabyte app center affected <= 1.05.21 fixed ?
- vendor:gigabyte oc guru ii affected = 2.08 fixed ?
- vendor:gigabyte xtreme gaming engine affected < 1.26 fixed 1.26

## How to check

Check whether GPCIDrv.sys or GDrv.sys exists on Windows machines, for example with: dir C:\Windows\System32\drivers\GPCIDrv.sys C:\Windows\System32\drivers\GDrv.sys
Check whether GIGABYTE App Center, AORUS Graphics Engine, XTREME Gaming Engine or OC GURU II is installed.

## Fix

Apply the vendor update for the GIGABYTE utility, or uninstall App Center, AORUS Graphics Engine, XTREME Gaming Engine and OC GURU II if they are not needed. Specific fixed versions: unknown.

## Timeline

- 2026-10-23T19:11:52+00:00 kev https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2018-19322
- 2026-10-23T22:29:04+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2018-19322

## From the sources

The GPCIDrv and GDrv low-level drivers in GIGABYTE App Center, AORUS Graphics Engine, XTREME Gaming Engine, and OC GURU II expose functionality to read/write data from/to IO ports. This could be leveraged in a number of ways to ultimately run code with elevated privileges.

CISA required action: Apply updates per vendor instructions.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_