CVE-2018-19321

Exploited in the wild. In CISA KEV since 2022‑10‑24. A vendor fix is available.

CVSS 3.17.8High EPSS percentile89th3.7% chance in 30 days CISA KEVListedsince 2022-10-24, due 2022-11-14
Public exploit: 1 source FixVendor fixNo build named by the sources

Published 2018-12-21Updated 2026-08-13Sources: CVE.org, NVD, BDU

NVD CVE.org

What to do

The vendor has published a fix. Version details are below where the sources state them.

Steps

Written by AI from the record

Check whether any of these are installed on business PCs: GIGABYTE APP Center (v1.05.21 or earlier), AORUS GRAPHICS ENGINE (before 1.57), XTREME GAMING ENGINE (before 1.26), or OC GURU II (v2.08 or earlier).
If affected, upgrade AORUS GRAPHICS ENGINE to 1.57.
If affected, upgrade XTREME GAMING ENGINE to 1.26.
If affected, upgrade OC GURU II to a version newer than 2.08 (use the vendor security update instructions).
If affected, upgrade GIGABYTE APP Center to 19.0422.1.
Recheck versions after updating to confirm the fixes are applied.
If you cannot upgrade quickly, disable/uninstall the vulnerable GIGABYTE components until updates are deployed (and remove them from automatic startup).

Vendor advisory Usually a quick update

Is your organisation exposed?Request an assessment to establish which checks fit your systems.

What it is

From the CVE record

The GPCIDrv and GDrv low-level drivers in GIGABYTE APP Center v1.05.21 and earlier, AORUS GRAPHICS ENGINE before 1.57, XTREME GAMING ENGINE before 1.26, and OC GURU II v2.08 expose functionality to read and write arbitrary physical memory. This could be leveraged by a local attacker to elevate privileges.

In plain language

Written by AI from the record

CVE-2018-19321 is a serious GIGABYTE software/driver flaw that can let an attacker misuse low-level memory on a GIGABYTE PC, and it has been used in ransomware attacks—so small businesses that have these tools installed should act now.

CVE-2018-19321 is a local privilege-escalation weakness in GIGABYTE APP Center and related low-level graphics/overclocking components (GPCIDrv/GDrv), where exposed driver functionality can be used to read/write arbitrary physical memory; the issue is confirmed in CISA KEV and has been used in ransomware campaigns, with fixed versions available.

If you're affected

Local attacker escalates to admin
Ransomware via post-compromise
System takeover risk
Service disruption from incidents

What is it

Some GIGABYTE PC tools include “low-level” drivers that talk directly to system memory. CVE-2018-19321 exposes functionality that can be misused to access memory in ways that can help an attacker gain higher control of the computer. Because it has been used in ransomware campaigns, it’s not just a theoretical risk.

Who is affected

This matters if you use computers with GIGABYTE APP Center, AORUS GRAPHICS ENGINE, XTREME GAMING ENGINE, or OC GURU II installed (especially older versions listed in the fixed-version details). It primarily helps a person who already has local access to the device, so the main risk is what could happen after an attacker gets onto a machine. This is most relevant when an infected device can be reached by attackers locally (for example, after a foothold), not just from a remote network service.

How urgent is it

This is an active, confirmed ransomware-related issue: it’s listed in CISA KEV and was used in ransomware campaigns. Because it enables local attackers to escalate privileges, you should treat it as RED for endpoints that have these GIGABYTE components installed and update promptly. Fixed versions are already available, so waiting provides little benefit.

What to do — in detail

Inventory affected endpoints
- For each business PC, check installed versions of:
  - GIGABYTE APP Center (affected when v1.05.21 or earlier)
  - AORUS GRAPHICS ENGINE (affected when before 1.57)
  - XTREME GAMING ENGINE (affected when before 1.26)
  - OC GURU II (affected when v2.08 or earlier)
Identify exposure to confirm scope
- If none of the components are installed, you are not affected by this CVE.
- If any component is in an affected version range, mark the PC for upgrade.
Upgrade to fixed versions (preferred remediation)
- Upgrade AORUS GRAPHICS ENGINE to 1.57.
- Upgrade XTREME GAMING ENGINE to 1.26.
- Upgrade GIGABYTE APP Center to 19.0422.1.
- Upgrade OC GURU II to a version newer than 2.08 following the vendor’s security guidance.
- Use the vendor remediation page for downloads and instructions: https://www.gigabyte.com/Support/Security/1801
Validate after patching
- Re-check each updated component’s version number.
- Confirm the vulnerable versions are no longer present.
Temporary workaround if upgrades are delayed
- Remove the vulnerable components (or uninstall them) where feasible.
- Alternatively, disable them to prevent use until upgraded (for example, remove from startup/disable the relevant functionality) in line with IT policy.
Operational guidance (what to monitor)
- Review endpoint alerts for signs of privilege escalation or unusual local activity following a breach.
- Ensure your incident response process considers “post-compromise privilege escalation via local tools/drivers” since KEV indicates ransomware usage.
KEV timing
- CISA KEV remediation due date for this item was 2022-11-14; treat upgrades as an urgent endpoint remediation even if you are currently unreported.

Technical context

Severity/impact: CVSS 7.8 (HIGH) indicates a meaningful risk, and the confirmed KEV status elevates priority beyond normal patching.

What’s vulnerable: GIGABYTE low-level drivers (GPCIDrv/GDrv) shipped with GIGABYTE APP Center and related components (AORUS GRAPHICS ENGINE, XTREME GAMING ENGINE, OC GURU II) expose functionality that can be abused to read and write arbitrary physical memory.

Attack mechanism: a local attacker can leverage the exposed driver functionality to access physical memory and then escalate privileges. (The provided findings emphasize local attacker capability.)

Exploitation status: Listed in CISA KEV (added 2022-10-24) and tied to ransomware campaigns; a public exploit is also available. This means real-world attack activity is not hypothetical.

Fix availability: vendor-fixed versions exist: AORUS GRAPHICS ENGINE fixed in 1.57; XTREME GAMING ENGINE fixed in 1.26; GIGABYTE APP Center fixed in 19.0422.1; OC GURU II fixed in a version newer than 2.08.

EPSS: A prediction was reported (trend falling), but KEV-confirmed ransomware use is treated as higher-priority evidence here.

What KEV means in this context: CISA KEV listing indicates the vulnerability is known to be exploited in the wild, prompting organizations to prioritize remediation on affected systems.

This is a general assessment based on public vulnerability data. It does not account for your specific infrastructure — when in doubt, consult a security specialist.

Exploitation

Where each signal puts this CVE on the scale from published to confirmed exploited.

EPSS89th

Public exploit

CISA KEV

Listed as exploited in the wild since 2022-10-24.

US federal agencies must remediate by 2022-11-14.

Known use in ransomware campaigns.

Apply updates per vendor instructions.

Public exploits

1 source with a proof of concept or module.

Exploit links, PoCs and Metasploit modules after sign-in

EPSS

3.7% chance of exploitation activity in the next 30 days, which ranks it in the 89th percentile of scored CVEs.

Exploit Prediction Scoring System, FIRST.org. A probability, not a confirmation.

Lifecycle

The patch came 119 days before any public exploit.

2026-08-13Patch availablerecord updated
2026-06-22EPSS band changemoderate → low
2026-03-06Public exploit / PoCsource: other
2025-11-07Patch availablerecord updated
2022-10-24Added to CISA KEVransomware campaign
2018-12-21Publishedweakness classified

Affected products

gigabytecommercial · TWaka oc guru ii, aorus graphics engine, app center
Gigabyte Technology Co., Ltd.commercial · TWaka gigabyte

And 1 more affected product. See all after sign-in

Technical detail

CVSS 3.1 vector

Open in the CVSS calculator

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Scored 7.8 by NVD.

How it is reached

Attack Vector LocalRequires local access to the vulnerable system (e.g. local login, malicious file)
Attack Complexity LowNo special conditions — the attack can be reliably reproduced
Privileges Required LowRequires basic user-level privileges
User Interaction NoneNo user interaction needed — fully automated exploitation

Scope

Scope UnchangedImpact is limited to the vulnerable component itself

Impact if exploited

Confidentiality HighTotal information disclosure — all data in the component is compromised
Integrity HighTotal loss of integrity — attacker can modify any data in the component
Availability HighTotal denial of service — the component is completely unavailable

Weaknesses

NVD-CWE-noinfoNo name in the record

Sources

References in the record

And 9 more references. See all after sign-in

Watch the software you run.

My Stack ranks new CVEs for your products by real-world exploitation, so the next exploited one reaches you without reading every advisory.

We'll flag the next CVE, public exploit or patch for Aorus Graphics Engine, not every advisory. This one: actively exploited.

A free account adds

The full version matrix and every affected product
Exploit links, proofs of concept and Metasploit modules
Email alerts for the products you watch
The same data over REST API, MCP and CLI

Create a free account