CVE-2018-19323
Critical 9.8 Exploited in the wild (KEV) Used in ransomware campaigns
Confirmed active exploitation — CISA KEV catalog
- Name
- GIGABYTE Multiple Products Privilege Escalation Vulnerability
- Added to catalog
- Remediation due date (US federal)
- Required action
- Apply updates per vendor instructions.
Description
The GDrv low-level driver in GIGABYTE APP Center v1.05.21 and earlier, AORUS GRAPHICS ENGINE before 1.57, XTREME GAMING ENGINE before 1.26, and OC GURU II v2.08 exposes functionality to read and write Machine Specific Registers (MSRs).
Metrics
- CVSS 3.1
-
9.8 (CRITICAL)
Score source: NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - EPSS — exploit probability
- 8% (percentile: 95) as of 1 November 2026
Affected products
gigabyte: aorus graphics engine; gigabyte: gigabyte app center; gigabyte: oc guru ii; gigabyte: xtreme gaming engine
References
- https://www.gigabyte.com/Support/Security/1801 Vendor Advisory
- https://www.gigabyte.com/Support/Security/1801 Vendor Advisory
- http://seclists.org/fulldisclosure/2018/Dec/39 ExploitMailing ListThird Party Advisory
- https://www.secureauth.com/labs/advisories/gigabyte-drivers-elevation-privilege… Broken LinkExploitThird Party Advisory
- http://seclists.org/fulldisclosure/2018/Dec/39 ExploitMailing ListThird Party Advisory
- https://www.secureauth.com/labs/advisories/gigabyte-drivers-elevation-privilege… Broken LinkExploitThird Party Advisory
- http://www.securityfocus.com/bid/106252 Broken LinkThird Party AdvisoryVDB Entry
- https://www.gigabyte.com/tw/Support/Utility/Graphics-Card Product
- http://www.securityfocus.com/bid/106252 Broken LinkThird Party AdvisoryVDB Entry
- https://www.gigabyte.com/tw/Support/Utility/Graphics-Card Product