CVE-2018-19322
GIGABYTE Multiple Products Code Execution Vulnerability
Published Dec 21, 2018 · updated Aug 12, 2026 · gigabyte aorus graphics engine
The GPCIDrv and GDrv low-level drivers in GIGABYTE APP Center v1.05.21 and earlier, AORUS GRAPHICS ENGINE before 1.57, XTREME GAMING ENGINE before 1.26, and OC GURU II v2.08 expose functionality to read/write data from/to IO ports. This could be leveraged in a number of ways to ultimately run code with elevated privileges.
Timeline
Detection, updates, and resolution for this record.
Dec 21, 2018 · Catalog
Detected
The GPCIDrv and GDrv low-level drivers in GIGABYTE APP Center v1.05.21 and earlier, AORUS GRAPHICS ENGINE before 1.57, XTREME GAMING ENGINE before 1.26, and OC GURU II v2.08 expose functionality to read/write data from/to IO ports. This could be leveraged in a number of ways to ultimately run code with elevated privileges.
Oct 24, 2022 · CISA KEV
Known exploited
Apply updates per vendor instructions.
Nov 14, 2022 · CISA KEV
Remediation due
Apply updates per vendor instructions.
Aug 12, 2026 · Catalog
Updated
The GPCIDrv and GDrv low-level drivers in GIGABYTE APP Center v1.05.21 and earlier, AORUS GRAPHICS ENGINE before 1.57, XTREME GAMING ENGINE before 1.26, and OC GURU II v2.08 expose functionality to read/write data from/to IO ports. This could be leveraged in a number of ways to ultimately run code with elevated privileges.
Required action
Apply updates per vendor instructions.
CISA due date Nov 14, 2022
Affected
- cpe gigabyte/aorus graphics engineversion unspecified
- cpe gigabyte/app centerversion unspecified
- cpe gigabyte/oc guru ii2.08
- cpe gigabyte/xtreme gaming engineversion unspecified
- vendor GIGABYTE Multiple Productsversion unspecified
Sources
- CISA KEVCVE-2018-19322
The GPCIDrv and GDrv low-level drivers in GIGABYTE App Center, AORUS Graphics Engine, XTREME Gaming Engine, and OC GURU II expose functionality to read/write data from/to IO ports. This could be leveraged in a number of ways to ultimately run code with elevated privileges.
cisa.gov - CVE.orgCVE-2018-19322
Official CVE identifier
cve.org - FIRST EPSSCVE-2018-19322
30-day exploitation probability 1.8%
first.org - NIST NVDCVE-2018-19322
The GPCIDrv and GDrv low-level drivers in GIGABYTE APP Center v1.05.21 and earlier, AORUS GRAPHICS ENGINE before 1.57, XTREME GAMING ENGINE before 1.26, and OC GURU II v2.08 expose functionality to read/write data from/to IO ports. This could be leveraged in a number of ways to u
nvd.nist.gov