ACTIVELY EXPLOITED
CVE-2018-19320: GIGABYTE Multiple Products Unspecified Vulnerability
| Vendor | GIGABYTE |
|---|---|
| Product | Multiple Products |
| Actively exploited | Yes |
| Added to CISA KEV | 24 Oct 2022 |
| CISA federal deadline | 14 Nov 2022 |
| Ransomware use | Known |
Required action (CISA's text)
Apply updates per vendor instructions.
Description (NVD)
The GDrv low-level driver in GIGABYTE App Center, AORUS Graphics Engine, XTREME Gaming Engine, and OC GURU II exposes ring0 memcpy-like functionality that could allow a local attacker to take complete control of the affected system.
SOURCES
Other GIGABYTE flaws
- CVE-2018-19323: GIGABYTE Multiple Products Privilege Escalation Vulnerability
- CVE-2018-19322: GIGABYTE Multiple Products Code Execution Vulnerability
- CVE-2018-19321: GIGABYTE Multiple Products Privilege Escalation Vulnerability
Data from NVD, CISA KEV, FIRST EPSS and vendor advisories. Updated 10 Nov 2026.