CVE-2018-19322

Exploited in the wild. In CISA KEV since 2022‑10‑24. A vendor fix is available.

CVSS 3.17.8High EPSS percentile78th1.8% chance in 30 days CISA KEVListedsince 2022-10-24, due 2022-11-14
No public exploit known FixVendor fixNo build named by the sources

Published 2018-12-21Updated 2026-08-13Sources: CVE.org, NVD, BDU

NVD CVE.org

What to do

The vendor has published a fix. Version details are below where the sources state them.

Steps

Written by AI from the record

Vendor advisory Usually a quick update

Is your organisation exposed?Request an assessment to establish which checks fit your systems.

What it is

From the CVE record

The GPCIDrv and GDrv low-level drivers in GIGABYTE APP Center v1.05.21 and earlier, AORUS GRAPHICS ENGINE before 1.57, XTREME GAMING ENGINE before 1.26, and OC GURU II v2.08 expose functionality to read/write data from/to IO ports. This could be leveraged in a number of ways to ultimately run code with elevated privileges.

In plain language

Written by AI from the record

This GIGABYTE software/drivers issue can let attackers use Windows low-level access to take over your system; if you use GIGABYTE APP Center, AORUS GRAPHICS ENGINE, XTREME GAMING ENGINE, or OC GURU II (older versions), you should treat it as a serious, real-world ransomware-related risk.

CVE-2018-19322 is a local privilege escalation weakness involving GPCIDrv/GDrv low-level drivers in GIGABYTE APP Center and related GIGABYTE graphics/overclock utilities; affected versions expose functionality to read/write to I/O ports, which has been used in ransomware campaigns and is listed in CISA KEV.

If you're affected

Full PC takeover
Ransomware risk
Data theft or corruption
Business disruption

What is it

This vulnerability lives in very low-level GIGABYTE driver software used by certain graphics and overclock tools. In simple terms, it gives a pathway for an attacker to use your PC’s hardware access in a way that can lead to taking over the computer. Because it’s been used in real ransomware activity, the safest move is to upgrade the affected GIGABYTE components.

Who is affected

This matters if you install or run GIGABYTE APP Center, AORUS GRAPHICS ENGINE, XTREME GAMING ENGINE, or OC GURU II on your business computers. It’s not just a “developer tool” issue—CISA lists it as having been used in ransomware campaigns. In practice, the risk becomes real when an attacker already has some foothold on the machine (for example, via phishing, stolen credentials, or another compromise), and then can leverage this local weakness to escalate privileges.

How urgent is it

This is RED because it’s confirmed in CISA’s KEV as being used in ransomware campaigns. Attackers have already been using this weakness in the real world, so waiting for “maybe” protection is not appropriate.

What to do — in detail

Confirm whether you’re affected

Inventory the machines in scope:
- Check whether you have any of these installed: GIGABYTE APP Center, AORUS GRAPHICS ENGINE, XTREME GAMING ENGINE, OC GURU II.
Capture the current installed versions.

Apply the vendor-fixed versions

AORUS GRAPHICS ENGINE: upgrade to 1.57 or later.
XTREME GAMING ENGINE: upgrade to 1.26 or later.
GIGABYTE APP Center: upgrade using the fixed version(s) and instructions from the vendor security notice for CVE-2018-19322.
OC GURU II: upgrade using the fixed version(s) and instructions from the vendor security notice for CVE-2018-19322 (the described affected line is up to v2.08).

Reference / due date

This issue is in CISA KEV with a remediation due date of 2022-11-14. If you have not already addressed it, treat this as overdue.

If patching is delayed (temporary containment)

Ensure endpoints are otherwise hardened to reduce the chance of initial compromise (since exploitation is local-prerequisite driven):
- Keep other critical software updated.
- Restrict admin rights for everyday users.
- Tighten remote access and email security.
Consider disabling or uninstalling the vulnerable GIGABYTE components until updates are applied, following your organization’s software needs (especially if those tools are not required for operations).

What to monitor

After updating, monitor endpoint logs/EDR alerts for suspicious privilege escalation behavior that might have occurred before the fix.
Verify the installed versions remain at or above the fixed versions after updates and reboots.

Technical context

What the vulnerability is

CVE-2018-19322 is a local privilege escalation issue (CWE-749) involving GIGABYTE low-level driver components (GPCIDrv and GDrv).
The weakness is described as exposing functionality to read/write data to I/O ports, which can be leveraged to ultimately run code with elevated privileges.

Exploitation status

CISA KEV lists this vulnerability as used in ransomware campaigns, added 2022-10-24, with a remediation due date of 2022-11-14.
No public exploit code is on record (per findings), but KEV inclusion indicates real-world impact.

Affected software and fixed versions

AORUS GRAPHICS ENGINE: fixed in 1.57.
XTREME GAMING ENGINE: fixed in 1.26.
GIGABYTE APP Center and OC GURU II have vendor remediation guidance via the linked security notice; update using the vendor’s instructions.

Risk framing for owners

Even though it’s a local privilege issue, KEV confirms it has been weaponized in ransomware scenarios; that combination makes it a high-priority update target for organizations running the affected software.

This is a general assessment based on public vulnerability data. It does not account for your specific infrastructure — when in doubt, consult a security specialist.

Exploitation

Where each signal puts this CVE on the scale from published to confirmed exploited.

EPSS78th

CISA KEV

Listed as exploited in the wild since 2022-10-24.

US federal agencies must remediate by 2022-11-14.

Known use in ransomware campaigns.

Apply updates per vendor instructions.

Public exploits

No public exploit or proof of concept found in the sources we track.

EPSS

1.8% chance of exploitation activity in the next 30 days, which ranks it in the 78th percentile of scored CVEs.

Exploit Prediction Scoring System, FIRST.org. A probability, not a confirmation.

Lifecycle

7 events over 2792 days, from the signal feeds we watch.

2026-08-13Patch availablerecord updated
2025-11-07Patch availablerecord updated
2022-10-24Added to CISA KEVransomware campaign
2018-12-21Publishedweakness classified

Affected products

gigabytecommercial · TWaka oc guru ii, aorus graphics engine, app center
Gigabyte Technology Co., Ltd.commercial · TWaka gigabyte

And 1 more affected product. See all after sign-in

Technical detail

CVSS 3.1 vector

Open in the CVSS calculator

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Scored 7.8 by NVD.

How it is reached

Attack Vector LocalRequires local access to the vulnerable system (e.g. local login, malicious file)
Attack Complexity LowNo special conditions — the attack can be reliably reproduced
Privileges Required LowRequires basic user-level privileges
User Interaction NoneNo user interaction needed — fully automated exploitation

Scope

Scope UnchangedImpact is limited to the vulnerable component itself

Impact if exploited

Confidentiality HighTotal information disclosure — all data in the component is compromised
Integrity HighTotal loss of integrity — attacker can modify any data in the component
Availability HighTotal denial of service — the component is completely unavailable

Weaknesses

CWE-749No name in the record

Sources

References in the record

And 9 more references. See all after sign-in

Watch the software you run.

My Stack ranks new CVEs for your products by real-world exploitation, so the next exploited one reaches you without reading every advisory.

We'll flag the next CVE, public exploit or patch for Aorus Graphics Engine, not every advisory. This one: actively exploited.

A free account adds

The full version matrix and every affected product
Exploit links, proofs of concept and Metasploit modules
Email alerts for the products you watch
The same data over REST API, MCP and CLI

Create a free account