CVE-2018-19320

HIGHCVSS 7.8Known Exploited

CISA Known Exploited Vulnerability

https://www.gigabyte.com/Support/Security/1801; https://nvd.nist.gov/vuln/detail/CVE-2018-19320

Remediation deadline: November 14, 2022

Ransomware use: Known

Description

The GDrv low-level driver in GIGABYTE App Center, AORUS Graphics Engine, XTREME Gaming Engine, and OC GURU II exposes ring0 memcpy-like functionality that could allow a local attacker to take complete control of the affected system.

Timeline

Published:December 21st, 2018 11:29 PM

Last modified:August 13th, 2026 5:17 AM

Added to KEV:October 24th, 2022

CVSS Scoring

CVSS v3: 7.8 (HIGH)

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CVSS v2: 7.2

Affected Software

From NVD CPE configuration data

Vendors

gigabyte

Products

aorus_graphics_engineapp_centeroc_guru_iixtreme_gaming_engine

References & Reports

Advisories, patches, and third-party reports

http://seclists.org/fulldisclosure/2018/Dec/39Exploit
http://www.securityfocus.com/bid/106252Broken Link
https://www.gigabyte.com/Support/Security/1801Vendor Advisory
https://www.gigabyte.com/tw/Support/Utility/Graphics-CardProduct
https://www.secureauth.com/labs/advisories/gigabyte-drivers-elevation-privilege-vulnerabilitiesBroken Link
http://seclists.org/fulldisclosure/2018/Dec/39Exploit
http://www.securityfocus.com/bid/106252Broken Link
https://www.gigabyte.com/Support/Security/1801Vendor Advisory
https://www.gigabyte.com/tw/Support/Utility/Graphics-CardProduct
https://www.secureauth.com/labs/advisories/gigabyte-drivers-elevation-privilege-vulnerabilitiesBroken Link
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2018-19320US Government Resource

Source: NIST NVD · Data may lag official sources by up to one minute