---
id: "CVE-2018-19323"
kind: "vulnerability"
aliases: ["CVE-2018-19323"]
title: "The GDrv low-level driver in GIGABYTE APP Center v1.05.21 and earlier, AORUS GRAPHICS ENGINE before 1.57, XTREME\u2026"
severity: "critical"
cvss: 9.8
epss: null
exploited: true
status: "open"
category: "infrastructure"
products: [{"name": "GIGABYTE Multiple Products", "fixed": [], "affected": "", "ecosystem": "vendor"}, {"name": "gigabyte aorus graphics engine", "fixed": ["1.57"], "affected": "< 1.57", "ecosystem": "vendor"}, {"name": "gigabyte app center", "fixed": [], "affected": "<= 1.05.21", "ecosystem": "vendor"}, {"name": "gigabyte oc guru ii", "fixed": [], "affected": "= 2.08", "ecosystem": "vendor"}, {"name": "gigabyte xtreme gaming engine", "fixed": ["1.26"], "affected": "< 1.26", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["endpoints", "exploited", "gigabyte", "infrastructure", "ransomware", "windows"]
not_affected_if: ["no-gigabyte-software-installed", "non-windows"]
published_at: "2018-12-21T23:29:00+00:00"
first_seen_at: "2026-10-23T19:11:52+00:00"
updated_at: "2026-10-23T22:29:04+00:00"
sources: [{"source": "kev", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2018-19323", "first_seen_at": "2026-10-23T19:11:52+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-19323", "first_seen_at": "2026-10-23T22:29:04+00:00"}]
---

# The GDrv low-level driver in GIGABYTE APP Center v1.05.21 and earlier, AORUS GRAPHICS ENGINE before 1.57, XTREME…

GIGABYTE's GPCIDrv and GDrv kernel drivers, shipped with App Center, AORUS Graphics Engine, XTREME Gaming Engine and OC GURU, let code read and write arbitrary physical memory. A local user can use this to gain higher privileges, and CISA lists it as exploited in the wild, including ransomware use.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:GIGABYTE Multiple Products affected ? fixed ?
- vendor:gigabyte aorus graphics engine affected < 1.57 fixed 1.57
- vendor:gigabyte app center affected <= 1.05.21 fixed ?
- vendor:gigabyte oc guru ii affected = 2.08 fixed ?
- vendor:gigabyte xtreme gaming engine affected < 1.26 fixed 1.26

## How to check

Check whether GPCIDrv.sys or GDrv.sys is present under the Windows drivers directory (C:\Windows\System32\drivers) or loaded via driverquery.
Check whether GIGABYTE App Center, AORUS Graphics Engine, XTREME Gaming Engine or OC GURU is installed.

## Fix

Apply the update from GIGABYTE per vendor instructions; remove the affected applications if not needed.

## Timeline

- 2026-10-23T19:11:52+00:00 kev https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2018-19323
- 2026-10-23T22:29:04+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2018-19323

## From the sources

The GPCIDrv and GDrv low-level drivers in GIGABYTE App Center, AORUS Graphics Engine, XTREME Gaming Engine, and OC GURU expose functionality to read and write arbitrary physical memory. This could be leveraged by a local attacker to elevate privileges.

CISA required action: Apply updates per vendor instructions.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_