ACTIVELY EXPLOITED
CVE-2018-19321: GIGABYTE Multiple Products Privilege Escalation Vulnerability
| Vendor | GIGABYTE |
|---|---|
| Product | Multiple Products |
| Actively exploited | Yes |
| Added to CISA KEV | 24 Oct 2022 |
| CISA federal deadline | 14 Nov 2022 |
| Ransomware use | Known |
Required action (CISA's text)
Apply updates per vendor instructions.
Description (NVD)
The GPCIDrv and GDrv low-level drivers in GIGABYTE App Center, AORUS Graphics Engine, XTREME Gaming Engine, and OC GURU II expose functionality to read and write arbitrary physical memory. This could be leveraged by a local attacker to elevate privileges.
SOURCES
Other GIGABYTE flaws
- CVE-2018-19323: GIGABYTE Multiple Products Privilege Escalation Vulnerability
- CVE-2018-19322: GIGABYTE Multiple Products Code Execution Vulnerability
- CVE-2018-19320: GIGABYTE Multiple Products Unspecified Vulnerability
Data from NVD, CISA KEV, FIRST EPSS and vendor advisories. Updated 10 Nov 2026.