CVE-2018-19321
Summary
| CVE | CVE-2018-19321 |
|---|---|
| State | PUBLISHED |
| Assigner | mitre |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2018-12-21 23:29:00 UTC |
| Updated | 2026-08-13 05:17:16 UTC |
| Description | The GPCIDrv and GDrv low-level drivers in GIGABYTE APP Center v1.05.21 and earlier, AORUS GRAPHICS ENGINE before 1.57, XTREME GAMING ENGINE before 1.26, and OC GURU II v2.08 expose functionality to read and write arbitrary physical memory. This could be leveraged by a local attacker to elevate privileges. |
Risk And Classification
Primary CVSS: v3.1 7.8 HIGH from [email protected]
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
EPSS: 0.036710000 probability, percentile 0.886940000 (date 2026-08-15)
CISA KEV: Listed on 2022-10-24; due 2022-11-14; ransomware use Known
Problem Types: NVD-CWE-noinfo | n/a | CWE-noinfo Not enough information
| Version | Source | Type | Score | Severity | Vector |
|---|---|---|---|---|---|
| 3.1 | [email protected] | Primary | 7.8 | HIGH | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
| 3.1 | ADP | DECLARED | 7.8 | HIGH | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
| 3.1 | 134c704f-9b21-4f2e-91b3-4a467353bcc0 | Secondary | 7.8 | HIGH | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
| 2.0 | [email protected] | Primary | 7.2 | AV:L/AC:L/Au:N/C:C/I:C/A:C |
CVSS v3.1 Breakdown
Attack Vector
LocalAttack Complexity
LowPrivileges Required
LowUser Interaction
NoneScope
UnchangedConfidentiality
HighIntegrity
HighAvailability
HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS v2.0 Breakdown
Access Vector
LocalAccess Complexity
LowAuthentication
NoneConfidentiality
CompleteIntegrity
CompleteAvailability
CompleteAV:L/AC:L/Au:N/C:C/I:C/A:C
CISA Known Exploited Vulnerability
| Vendor | GIGABYTE |
|---|---|
| Product | Multiple Products |
| Name | GIGABYTE Multiple Products Privilege Escalation Vulnerability |
| Required Action | Apply updates per vendor instructions. |
| Notes | https://www.gigabyte.com/Support/Security/1801; https://nvd.nist.gov/vuln/detail/CVE-2018-19321 |
NVD Known Affected Configurations (CPE 2.3)
| Type | Vendor | Product | Version | Update | Edition | Language |
|---|---|---|---|---|---|---|
| Application | Gigabyte | Aorus Graphics Engine | All | All | All | All |
| Application | Gigabyte | App Center | All | All | All | All |
| Application | Gigabyte | Oc Guru Ii | 2.08 | All | All | All |
| Application | Gigabyte | Xtreme Gaming Engine | All | All | All | All |
Vendor Declared Affected Products
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| www.cisa.gov/known-exploited-vulnerabilities-catalog | 134c704f-9b21-4f2e-91b3-4a467353bcc0 | www.cisa.gov | US Government Resource |
| Software update for Potential security vulnerabilities in GIGABYTE software | Security & Technical Advisory - GIGABYTE Global | af854a3a-2127-422b-91ae-364da2661108 | www.gigabyte.com | Vendor Advisory |
| GIGABYTE Drivers Elevation of Privilege Vulnerabilities | SecureAuth | af854a3a-2127-422b-91ae-364da2661108 | www.secureauth.com | Broken Link, Exploit, Third Party Advisory |
| Full Disclosure: [CORE-2018-0007] - GIGABYTE Driver Elevation of Privilege Vulnerabilities | af854a3a-2127-422b-91ae-364da2661108 | seclists.org | Exploit, Mailing List, Third Party Advisory |
| Multiple GIGABYTE Products Multiple Arbitrary Code Execution Vulnerabilities | af854a3a-2127-422b-91ae-364da2661108 | www.securityfocus.com | Broken Link, Third Party Advisory, VDB Entry |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
| CISA Known Exploited Vulnerabilities catalog | CISA | www.cisa.gov | kev |
No vendor comments have been submitted for this CVE.
Additional Advisory Data
| Source | Time | Event |
|---|---|---|
| ADP | 2022-10-24T00:00:00.000Z | CVE-2018-19321 added to CISA KEV |
There are currently no legacy QID mappings associated with this CVE.