CVE-2018-19323
critical CISA KEVGIGABYTE Multiple Products Privilege Escalation Vulnerability
Vendor / product: GIGABYTE — Multiple Products
The GDrv low-level driver in GIGABYTE APP Center v1.05.21 and earlier, AORUS GRAPHICS ENGINE before 1.57, XTREME GAMING ENGINE before 1.26, and OC GURU II v2.08 exposes functionality to read and write Machine Specific Registers (MSRs).
CVSS
9.8
9.8 (CVSS v3.1)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Severity source: NVD CVSS v3.1 (nvd@nist.gov)
Timeline (UTC)
Published: 2018-12-21 23:29
Modified: 2026-10-01 21:17
NVD status: Analyzed
Last synced 1 day ago
Verified against the source API 2026-10-27 07:07 UTC
Exploitation
Listed in CISA KEV
Added 2022-10-24 · due 2022-11-14
Known ransomware use: Known
Required action (CISA)
Apply updates per vendor instructions.
Affected products
gigabyte / aorus_graphics_engine <1.57
gigabyte / gigabyte_app_center ≤1.05.21
gigabyte / oc_guru_ii 2.08
gigabyte / xtreme_gaming_engine <1.26
Weakness classification (CWE)
NVD-CWE-noinfo
Source: NVD / CISA. “NVD-CWE-Other” and “NVD-CWE-noinfo” mean NVD could not assign a specific weakness.
Mitigation & advisories
Vendor advisory: https://www.gigabyte.com/Support/Security/1801
Vendor advisory: https://www.gigabyte.com/Support/Security/1801
References
- http://seclists.org/fulldisclosure/2018/Dec/39 cve@mitre.org
- http://www.securityfocus.com/bid/106252 cve@mitre.org
- https://www.gigabyte.com/Support/Security/1801 cve@mitre.org
- https://www.gigabyte.com/tw/Support/Utility/Graphics-Card cve@mitre.org
- https://www.secureauth.com/labs/advisories/gigabyte-drivers-elevation-privilege-vulnerabil... cve@mitre.org
- http://seclists.org/fulldisclosure/2018/Dec/39 af854a3a-2127-422b-91ae-364da2661108
- http://www.securityfocus.com/bid/106252 af854a3a-2127-422b-91ae-364da2661108
- https://www.gigabyte.com/Support/Security/1801 af854a3a-2127-422b-91ae-364da2661108
- https://www.gigabyte.com/tw/Support/Utility/Graphics-Card af854a3a-2127-422b-91ae-364da2661108
- https://www.secureauth.com/labs/advisories/gigabyte-drivers-elevation-privilege-vulnerabil... af854a3a-2127-422b-91ae-364da2661108
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2018-19323 134c704f-9b21-4f2e-91b3-4a467353bcc0
Data sources
CISA KEV — fetched 2026-10-27 06:50 UTC · record ↗
NVD CVE API 2.0 — fetched 2026-10-27 07:07 UTC · record ↗