CVE-2018-19320: GIGABYTE Multiple Products Unspecified Vulnerability

High severity, CVSS 7.8. Actively exploited: in CISA KEV since 2022-10-24. EPSS: 3.6% chance of exploitation in the next 30 days.

The GDrv low-level driver in GIGABYTE APP Center v1.05.21 and earlier, AORUS GRAPHICS ENGINE before 1.57, XTREME GAMING ENGINE before 1.26, and OC GURU II v2.08 exposes ring0 memcpy-like functionality that could allow a local attacker to take complete control of the affected system.

Affected products

• GIGABYTE Aorus Graphics Engine: before 1.57 (fixed in 1.57)
• GIGABYTE App Center: before 19.0422.1 (fixed in 19.0422.1)
• GIGABYTE Oc Guru Ii: version 2.08 only
• GIGABYTE Xtreme Gaming Engine: before 1.26 (fixed in 1.26)

Published 2018-12-21. Last modified 2026-08-13.