CVE-2018-19320

KEVRansomware UseGIGABYTE Multiple Products Unspecified Vulnerability

Description

The GDrv low-level driver in GIGABYTE App Center, AORUS Graphics Engine, XTREME Gaming Engine, and OC GURU II exposes ring0 memcpy-like functionality that could allow a local attacker to take complete control of the affected system.

The GDrv low-level driver in GIGABYTE APP Center v1.05.21 and earlier, AORUS GRAPHICS ENGINE before 1.57, XTREME GAMING ENGINE before 1.26, and OC GURU II v2.08 exposes ring0 memcpy-like functionality that could allow a local attacker to take complete control of the affected system.

CVSS 3.1 vectorCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

PublishedDec 21, 2018

Last modifiedAug 13, 2026

Added to KEVOct 24, 2022

Remediation dueNov 14, 2022

References

seclists.org/fulldisclosure/2018/Dec/39ExploitMailing List
securityfocus.com/bid/106252Broken LinkThird Party Advisory
gigabyte.com/Support/Security/1801Vendor Advisory
gigabyte.com/tw/Support/Utility/Graphics-CardProduct
secureauth.com/labs/advisories/gigabyte-drivers-elevation-privilege-vulnerabilitiesBroken LinkExploit
cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2018-19320US Government Resource

0 recent articles mention this CVE

Risk assessment · High

Actively exploited and used by ransomware crews. Patch immediately.

Exploitation: Confirmed in the wild (CISA KEV)
Federal remediation deadline: Overdue by 1442 days
Ransomware: Used in known ransomware campaigns
CVSS: 7.8 HIGH
EPSS (30-day exploit probability): 4.6% · top 8% of all CVEs
Weakness: NVD-CWE-noinfo

Recommended actions

1.Apply updates per vendor instructions.
2.Treat as emergency change: patch or isolate internet-facing instances first.
3.Hunt for compromise: review logs for the disclosure window, not just from the patch date.
4.Verify offline/immutable backups and segment the affected systems. This flaw is used for ransomware initial access.

Assessment is derived automatically from the live signals above; verify against your own asset inventory.