CVE-2018-19323
KEVRansomware UseGIGABYTE Multiple Products Privilege Escalation Vulnerability
Description
The GPCIDrv and GDrv low-level drivers in GIGABYTE App Center, AORUS Graphics Engine, XTREME Gaming Engine, and OC GURU expose functionality to read and write arbitrary physical memory. This could be leveraged by a local attacker to elevate privileges.
The GDrv low-level driver in GIGABYTE APP Center v1.05.21 and earlier, AORUS GRAPHICS ENGINE before 1.57, XTREME GAMING ENGINE before 1.26, and OC GURU II v2.08 exposes functionality to read and write Machine Specific Registers (MSRs).
CVSS 3.1 vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HPublishedDec 21, 2018
Last modifiedOct 1, 2026
Added to KEVOct 24, 2022
Remediation dueNov 14, 2022
References
- seclists.org/fulldisclosure/2018/Dec/39ExploitMailing List
- securityfocus.com/bid/106252Broken LinkThird Party Advisory
- gigabyte.com/Support/Security/1801Vendor Advisory
- gigabyte.com/tw/Support/Utility/Graphics-CardProduct
- secureauth.com/labs/advisories/gigabyte-drivers-elevation-privilege-vulnerabilitiesBroken LinkExploit
- cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2018-19323US Government Resource
0 recent articles mention this CVE
90
Risk assessment · Critical
Actively exploited and used by ransomware crews. Patch immediately.
- Exploitation
- Confirmed in the wild (CISA KEV)
- Federal remediation deadline
- Overdue by 1442 days
- Ransomware
- Used in known ransomware campaigns
- CVSS
- 9.8 CRITICAL
- EPSS (30-day exploit probability)
- 8.4% · top 5% of all CVEs
- Weakness
- NVD-CWE-noinfo
- Attack vector
- Network, remotely reachable
- Preconditions
- No privileges and no user interaction
Recommended actions
- 1.Apply updates per vendor instructions.
- 2.Treat as emergency change: patch or isolate internet-facing instances first.
- 3.Review exposure: confirm which instances are reachable from the internet and restrict access until patched.
- 4.Hunt for compromise: review logs for the disclosure window, not just from the patch date.
- 5.Verify offline/immutable backups and segment the affected systems. This flaw is used for ransomware initial access.
Assessment is derived automatically from the live signals above; verify against your own asset inventory.