CVE-2018-19323
Summary
| CVE | CVE-2018-19323 |
|---|---|
| State | PUBLISHED |
| Assigner | mitre |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2018-12-21 23:29:00 UTC |
| Updated | 2026-08-13 05:17:17 UTC |
| Description | The GDrv low-level driver in GIGABYTE APP Center v1.05.21 and earlier, AORUS GRAPHICS ENGINE before 1.57, XTREME GAMING ENGINE before 1.26, and OC GURU II v2.08 exposes functionality to read and write Machine Specific Registers (MSRs). |
Risk And Classification
Primary CVSS: v3.1 9.8 CRITICAL from [email protected]
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS: 0.085230000 probability, percentile 0.945690000 (date 2026-08-15)
CISA KEV: Listed on 2022-10-24; due 2022-11-14; ransomware use Known
Problem Types: NVD-CWE-noinfo | n/a | CWE-noinfo Not enough information
| Version | Source | Type | Score | Severity | Vector |
|---|---|---|---|---|---|
| 3.1 | [email protected] | Primary | 9.8 | CRITICAL | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| 3.1 | ADP | DECLARED | 9.8 | CRITICAL | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| 3.1 | 134c704f-9b21-4f2e-91b3-4a467353bcc0 | Secondary | 9.8 | CRITICAL | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| 2.0 | [email protected] | Primary | 9 | AV:N/AC:L/Au:N/C:P/I:P/A:C |
CVSS v3.1 Breakdown
Attack Vector
NetworkAttack Complexity
LowPrivileges Required
NoneUser Interaction
NoneScope
UnchangedConfidentiality
HighIntegrity
HighAvailability
HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v2.0 Breakdown
Access Vector
NetworkAccess Complexity
LowAuthentication
NoneConfidentiality
PartialIntegrity
PartialAvailability
CompleteAV:N/AC:L/Au:N/C:P/I:P/A:C
CISA Known Exploited Vulnerability
| Vendor | GIGABYTE |
|---|---|
| Product | Multiple Products |
| Name | GIGABYTE Multiple Products Privilege Escalation Vulnerability |
| Required Action | Apply updates per vendor instructions. |
| Notes | https://www.gigabyte.com/Support/Security/1801; https://nvd.nist.gov/vuln/detail/CVE-2018-19323 |
NVD Known Affected Configurations (CPE 2.3)
| Type | Vendor | Product | Version | Update | Edition | Language |
|---|---|---|---|---|---|---|
| Application | Gigabyte | Aorus Graphics Engine | All | All | All | All |
| Application | Gigabyte | Gigabyte App Center | All | All | All | All |
| Application | Gigabyte | Oc Guru Ii | 2.08 | All | All | All |
| Application | Gigabyte | Xtreme Gaming Engine | All | All | All | All |
Vendor Declared Affected Products
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| www.cisa.gov/known-exploited-vulnerabilities-catalog | 134c704f-9b21-4f2e-91b3-4a467353bcc0 | www.cisa.gov | US Government Resource |
| Software update for Potential security vulnerabilities in GIGABYTE software | Security & Technical Advisory - GIGABYTE Global | af854a3a-2127-422b-91ae-364da2661108 | www.gigabyte.com | Vendor Advisory |
| GIGABYTE Drivers Elevation of Privilege Vulnerabilities | SecureAuth | af854a3a-2127-422b-91ae-364da2661108 | www.secureauth.com | Broken Link, Exploit, Third Party Advisory |
| Full Disclosure: [CORE-2018-0007] - GIGABYTE Driver Elevation of Privilege Vulnerabilities | af854a3a-2127-422b-91ae-364da2661108 | seclists.org | Exploit, Mailing List, Third Party Advisory |
| Multiple GIGABYTE Products Multiple Arbitrary Code Execution Vulnerabilities | af854a3a-2127-422b-91ae-364da2661108 | www.securityfocus.com | Broken Link, Third Party Advisory, VDB Entry |
| 工具程式 | 服務 / 支援 - GIGABYTE 技嘉科技 | af854a3a-2127-422b-91ae-364da2661108 | www.gigabyte.com | Product |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
| CISA Known Exploited Vulnerabilities catalog | CISA | www.cisa.gov | kev |
No vendor comments have been submitted for this CVE.
Additional Advisory Data
| Source | Time | Event |
|---|---|---|
| ADP | 2022-10-24T00:00:00.000Z | CVE-2018-19323 added to CISA KEV |
There are currently no legacy QID mappings associated with this CVE.