CVE-2018-19320: GIGABYTE Multiple Products Unspecified Vulnerability
Vulnerability summary
CVE-2018-19320 is a high (CVSS 7.8) vulnerability in GIGABYTE Multiple Products. It is known to be exploited: CISA lists it, first on 24-10-2022. It has been used in ransomware campaigns. EPSS estimates a 3.60% chance of exploitation in the next 30 days, higher than 89.3% of scored vulnerabilities. 2 public exploits are recorded.
Timeline
- 21-12-2018PublishedVulnerability first disclosed.
- 24-10-2022Added to CISA KEVGIGABYTE Multiple Products Unspecified Vulnerability
- 14-11-2022CISA remediation dueApply updates per vendor instructions.
- 13-08-2026Last modifiedVulnerability information updated.
Description
The GDrv low-level driver in GIGABYTE APP Center v1.05.21 and earlier, AORUS GRAPHICS ENGINE before 1.57, XTREME GAMING ENGINE before 1.26, and OC GURU II v2.08 exposes ring0 memcpy-like functionality that could allow a local attacker to take complete control of the affected system.
CVSS metrics
3 scores · 2 sources · 2 versions- NVDNIST7.8HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
EPSS trend
Probability
3.60%
Chance of exploitation in the next 30 days
Percentile
89%
Versus all other CVEs
30-day change
0.00 pp
From 3.60% on 20-09-2026
Known exploited
Compare KEV catalogs
CISA KEVListed- Added
- 24-10-2022
- Federal due date
- 14-11-2022
CISA required action
Apply updates per vendor instructions. www.gigabyte.com/Support/Security/1801 nvd.nist.gov/vuln/detail/CVE-2018-19320
Public exploits
2 foundExploit Reference (seclists.org)
Maturity: unknown
Exploit Reference (secureauth.com)
Maturity: unknown
Weaknesses
CWE · root causeNo weakness data has been published for this record.
Affected systems
Gigabyte4 products
- aorus_graphics_engine< 1.57
- app_center< 19.0422.1
- oc_guru_ii2.08
- xtreme_gaming_engine< 1.26
1 vendor · 4 products
References
6 links- www.secureauth.com/labs/advisories/gigabyte-drivers-elevation-privilege-vulnerabilitiesX Refsource MISCBroken LinkExploitThird Party Advisory
- www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2018-19320Government ResourceUS Government Resource