Gigabyte vulnerabilities
20 vulnerabilities
Known vulnerabilities in Gigabyte products, newest first, with CVSS severity, EPSS, KEV listings and ransomware use, across 672 products.
Products
50 of 672- Aorus Graphics Engine4 vulnerabilities
- App Center4 vulnerabilities
- Oc Guru Ii4 vulnerabilities
- Xtreme Gaming Engine4 vulnerabilities
- Dldrv2 Activex Control2 vulnerabilities
- Gb Bsi7H 65002 vulnerabilities
- Gb Bxi7 57752 vulnerabilities
- UEFI Genericcomponentsmmentry2 vulnerabilities
- AMD 600 Chipset Motherboard1 vulnerabilities
- AMD 800 Chipset Motherboard1 vulnerabilities
- AMD Trx50 Chipset Motherboard1 vulnerabilities
- B760M D2HX LITE SI (Rev. 1.0)1 vulnerabilities
- C621 Aorus Xtreme (Rev. 1.0)1 vulnerabilities
- C621 SD81 vulnerabilities
- C621 SU8 (Rev. 1.0)1 vulnerabilities
- C621 WD121 vulnerabilities
- C621 WD12 IPMI (Rev. 1.0)1 vulnerabilities
- Control Center1 vulnerabilities
- D120 C20 (Rev. 230)1 vulnerabilities
- E133 C101 vulnerabilities
- E133 C10 (Rev. Aaa1)1 vulnerabilities
- E152 ZE01 vulnerabilities
- E152 ZE1 (Rev. A00)1 vulnerabilities
- E162 2201 vulnerabilities
- E163 S30 (Rev. Aab1)1 vulnerabilities
- E163 Z301 vulnerabilities
- E251 U70 (Rev. 100)1 vulnerabilities
- E283 S90 (Rev. Aad1)1 vulnerabilities
- E283 Z901 vulnerabilities
- E283 Z91 (Rev. Aav1)1 vulnerabilities
- EL 20 3060 32G (Rev. 1.0)1 vulnerabilities
- EL 30 (Rev. 1.0)1 vulnerabilities
- G150 B10 (Rev. 111)1 vulnerabilities
- G152 Z121 vulnerabilities
- G152 Z12 (Rev. 200)1 vulnerabilities
- G180 G00 (Rev. 100)1 vulnerabilities
- G182 C201 vulnerabilities
- G190 G301 vulnerabilities
- G190 H441 vulnerabilities
- G191 H441 vulnerabilities
- G1.Sniper 3 (Rev. 1.0)1 vulnerabilities
- G1.Sniper B71 vulnerabilities
- G1.Sniper M31 vulnerabilities
- G1.Sniper M7 (Rev. 1.0)1 vulnerabilities
- G1.Sniper Z170 (Rev. 1.0)1 vulnerabilities
- G210 H4G (Rev. 100)1 vulnerabilities
- G211 H4G1 vulnerabilities
- G221 Z301 vulnerabilities
- G241 G40 (Rev. 100)1 vulnerabilities
- G242 Z101 vulnerabilities
CVE-2018-19320gigabyteaorus_graphics_engine+3KEVRansomware
EPSS score3.60%
The GDrv low-level driver in GIGABYTE APP Center v1.05.21 and earlier, AORUS GRAPHICS ENGINE before 1.57, XTREME GAMING ENGINE before 1.26, and OC GURU II v2.08 exposes ring0 memcpy-like functionality that could allow a local attacker to take complete control of the affected system.CVE-2018-19322gigabyteaorus_graphics_engine+3KEVRansomwareEPSS score1.82%
The GPCIDrv and GDrv low-level drivers in GIGABYTE APP Center v1.05.21 and earlier, AORUS GRAPHICS ENGINE before 1.57, XTREME GAMING ENGINE before 1.26, and OC GURU II v2.08 expose functionality to read/write data from/to IO ports. This could be leveraged in a number of ways to ultimately run code with elevated privileges.CVE-2018-19323gigabyteaorus_graphics_engine+3KEVRansomwareEPSS score8.36%
The GDrv low-level driver in GIGABYTE APP Center v1.05.21 and earlier, AORUS GRAPHICS ENGINE before 1.57, XTREME GAMING ENGINE before 1.26, and OC GURU II v2.08 exposes functionality to read and write Machine Specific Registers (MSRs).CVE-2018-19321gigabyteaorus_graphics_engine+3KEVRansomwareEPSS score3.70%
The GPCIDrv and GDrv low-level drivers in GIGABYTE APP Center v1.05.21 and earlier, AORUS GRAPHICS ENGINE before 1.57, XTREME GAMING ENGINE before 1.26, and OC GURU II v2.08 expose functionality to read and write arbitrary physical memory. This could be leveraged by a local attacker to elevate privileges.CVE-2025-14302gigabyteamd 600 chipset motherboard+5EPSS score0.35%
Certain motherboard models developed by GIGABYTE has a Protection Mechanism Failure vulnerability. Because IOMMU was not properly enabled, unauthenticated physical attackers can use a DMA-capable PCIe device to read and write arbitrary physical memory before the OS kernel and its security features are loaded.CVE-2025-7029gigabyteuefi-overclocksmihandlerEPSS score0.27%
A vulnerability in the Software SMI handler (SwSmiInputValue 0xB2) allows a local attacker to control the RBX register, which is used to derive pointers (OcHeader, OcData) passed into power and thermal configuration logic. These buffers are not validated before performing multiple structured memory writes based on OcSetup NVRAM values, enabling arbitrary SMRAM corruption and potential SMM privilege escalation.CVE-2025-7027gigabyteuefi-genericcomponentsmmentryEPSS score0.23%
A vulnerability in the Software SMI handler (SwSmiInputValue 0xB2) allows a local attacker to control both the read and write addresses used by the CommandRcx1 function. The write target is derived from an unvalidated UEFI NVRAM variable (SetupXtuBufferAddress), while the write content is read from an attacker-controlled pointer based on the RBX register. This dual-pointer dereference enables arbitrary memory writes within System Management RAM (SMRAM), leading to potential SMM privilege escalation and firmware compromise.CVE-2025-7026gigabyteuefi-genericcomponentsmmentryEPSS score0.23%
A vulnerability in the Software SMI handler (SwSmiInputValue 0xB2) allows a local attacker to control the RBX register, which is used as an unchecked pointer in the CommandRcx0 function. If the contents at RBX match certain expected values (e.g., '$DB$' or '2DB$'), the function performs arbitrary writes to System Management RAM (SMRAM), leading to potential privilege escalation to System Management Mode (SMM) and persistent firmware compromise.CVE-2025-7028gigabyteuefi-smiflashEPSS score0.23%
A vulnerability in the Software SMI handler (SwSmiInputValue 0x20) allows a local attacker to supply a crafted pointer (FuncBlock) through RBX and RCX register values. This pointer is passed unchecked into multiple flash management functions (ReadFlash, WriteFlash, EraseFlash, and GetFlashInfo) that dereference both the structure and its nested members, such as BufAddr. This enables arbitrary read/write access to System Management RAM (SMRAM), allowing an attacker to corrupt firmware memory, exfiltrate SMRAM content via flash, or install persistent implants.CVE-2010-1517gigabytedldrv2_activex_controlEPSS score1.84%
The GIGABYTE Dldrv2 ActiveX control 1.4.206.11 allows remote attackers to (1) download arbitrary programs onto a client system, and execute these programs, via vectors involving the dl method; and (2) download arbitrary programs onto a client system via vectors involving the SetDLInfo method in conjunction with the Bdl method.CVE-2010-1518gigabytedldrv2_activex_controlEPSS score3.22%
Array index error in the SetDLInfo method in the GIGABYTE Dldrv2 ActiveX control 1.4.206.11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via the item argument.CVE-2017-3197gigabytegb-bsi7h-6500_firmware+1EPSS score5.57%
GIGABYTE BRIX UEFI firmware for the GB-BSi7H-6500 (version F6) and GB-BXi7-5775 (version F2) platforms does not securely implement BIOSWE, BLE, SMM_BWP, and PRx features. As a result, the BIOS is not protected from arbitrary write access and may permit modifications to the SPI flash.CVE-2017-3198gigabytegb-bsi7h-6500_firmware+1EPSS score1.58%
GIGABYTE BRIX UEFI firmware does not cryptographically validate images prior to updating the system firmware. Additionally, the firmware updates are served over HTTP. An attacker can make arbitrary modifications to firmware images without being detected.CVE-2004-0328gigabytegn-b46bEPSS score0.36%
Gigabyte Gn-B46B 2.4Ghz wireless broadband router firmware 1.003.00 allows local users on the same local network as the router to bypass authentication by using a copy of the router's html menu on a separate system.CVE-2024-8105aceraltos r680 f4+742EPSS score0.27%
A vulnerability exists in UEFI implementations that use a hard-coded software-based Platform Key (PK). An attacker in possession of the corresponding PK private key can sign arbitrary UEFI executables or firmware components, causing them to be trusted by affected systems and potentially bypassing UEFI Secure Boot trust validation.CVE-2019-7630gigabyteapp_centerEPSS score3.08%
An issue was discovered in gdrv.sys in Gigabyte APP Center before 19.0227.1. The vulnerable driver exposes a wrmsr instruction via IOCTL 0xC3502580 and does not properly filter the target Model Specific Register (MSR). Allowing arbitrary MSR writes can lead to Ring-0 code execution and escalation of privileges.CVE-2026-0870gigabytemacrohubEPSS score0.14%
MacroHub developed by GIGABYTE has a Local Privilege Escalation vulnerability. Due to the MacroHub application launching external applications with improper privileges, allowing authenticated local attackers to execute arbitrary code with SYSTEM privileges.CVE-2026-9492gigabytembstorageEPSS score0.16%
The MBStorage DRAM lighting control module within Gigabyte Control Center (GCC) developed by GIGABYTE Technology has an Improper Access Control vulnerability. Authenticated local attackers can send specific IOCTL commands through the driver MyPortIO_x64.sys bundled with the module, thereby arbitrarily reading and writing physical memory and obtaining kernel-level privileges.CVE-2026-4415gigabytecontrol_center+1EPSS score0.94%
Gigabyte Control Center developed by GIGABYTE has an Arbitrary File Write vulnerability. When the pairing feature is enabled, unauthenticated remote attackers can write arbitrary files to any location on the underlying operating system, leading to arbitrary code execution or privilege escalation.CVE-2026-4416gigabyteperformance_libraryEPSS score0.34%
The Performance Library component of Gigabyte Control Center has an Insecure Deserialization vulnerability. Authenticated local attackers can send a malicious serialized payload to the EasyTune Engine service, resulting in privilege escalation.