{"id":"CVE-2018-19321","published":"2018-12-21T23:29:00Z","modified":"2026-08-13T05:17:16Z","title":"GIGABYTE Multiple Products Privilege Escalation Vulnerability","vendor":"GIGABYTE","product":"Multiple Products","tier":"core","eol":null,"description":{"text":"The GPCIDrv and GDrv low-level drivers in GIGABYTE APP Center v1.05.21 and earlier, AORUS GRAPHICS ENGINE before 1.57, XTREME GAMING ENGINE before 1.26, and OC GURU II v2.08 expose functionality to read and write arbitrary physical memory. This could be leveraged by a local attacker to elevate privileges.","provenance":"source","from":"NVD"},"summary":{"text":"The GPCIDrv and GDrv low-level drivers in GIGABYTE APP Center (v1.05.21 and earlier), AORUS GRAPHICS ENGINE (before 1.57), XTREME GAMING ENGINE (before 1.26), and OC GURU II (v2.08) expose functionality that reads and writes arbitrary physical memory. A local attacker with low privileges and no user interaction can use this to elevate privileges.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-23T07:01:24Z"},"cvss":{"score":7.8,"severity":"HIGH","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","provenance":"source","from":"NVD"},"epss":{"score":0.03701,"percentile":0.89696,"date":"2026-10-28","provenance":"source"},"kev":{"dateAdded":"2022-10-24","dueDate":"2022-11-14","ransomware":true,"requiredAction":"Apply updates per vendor instructions.","notes":"https://www.gigabyte.com/Support/Security/1801; https://nvd.nist.gov/vuln/detail/CVE-2018-19321","provenance":"source"},"vulncheckKev":{"dateAdded":"2022-10-24","exploitedFirstSeen":"2022-10-24","ransomware":true,"evidence":[{"url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","date":"2022-10-24"},{"url":"https://info.securin.io/hubfs/Securin%20Ransomware%20Report%202023.pdf","date":"2023-02-14"},{"url":"https://bi.zone/upload/for_download/Threat_Zone_2025_BI.ZONE_Research_rus.pdf","date":"2025-04-08"}],"evidenceTotal":3,"provenance":"source"},"exploited":true,"otx":{"pulseCount":50,"pulses":[{"name":"Actively_Exploited_Kev | Oct 29, 2026","url":"https://otx.alienvault.com/pulse/6ae20c1db17e7057ae7d9ad1","created":"2026-10-28"},{"name":"Actively_Exploited_Kev | Oct 28, 2026","url":"https://otx.alienvault.com/pulse/6ae0ba7e0e2a97ff7b218819","created":"2026-10-27"},{"name":"Actively_Exploited_Kev | Oct 27, 2026","url":"https://otx.alienvault.com/pulse/6adf68b85c3e852f3c111d18","created":"2026-10-26"},{"name":"Actively_Exploited_Kev | Oct 24, 2026","url":"https://otx.alienvault.com/pulse/6adb740e397c3ad4799aa4cd","created":"2026-10-23"},{"name":"Actively_Exploited_Kev | Oct 23, 2026","url":"https://otx.alienvault.com/pulse/6ada236fcfba2dfa730ea482","created":"2026-10-22"},{"name":"Actively_Exploited_Kev | Oct 22, 2026","url":"https://otx.alienvault.com/pulse/6ad8d33a077cbb5cab524d80","created":"2026-10-21"},{"name":"Actively_Exploited_Kev | Oct 21, 2026","url":"https://otx.alienvault.com/pulse/6ad78130c4d1ac2be83a8b6d","created":"2026-10-20"},{"name":"Actively_Exploited_Kev | Oct 20, 2026","url":"https://otx.alienvault.com/pulse/6ad62f63c24a405a3423cc13","created":"2026-10-19"},{"name":"Actively_Exploited_Kev | Oct 19, 2026","url":"https://otx.alienvault.com/pulse/6ad4dda174e5797d0bd238b7","created":"2026-10-18"},{"name":"Actively_Exploited_Kev | Oct 18, 2026","url":"https://otx.alienvault.com/pulse/6ad38c22e1848f8189d1c121","created":"2026-10-17"}],"provenance":"machine"},"cwes":[],"references":[{"url":"http://seclists.org/fulldisclosure/2018/Dec/39","tags":["Exploit","Mailing List","Third Party Advisory"]},{"url":"http://www.securityfocus.com/bid/106252","tags":["Broken Link","Third Party Advisory","VDB Entry"]},{"url":"https://www.gigabyte.com/Support/Security/1801","tags":["Vendor Advisory"]},{"url":"https://www.secureauth.com/labs/advisories/gigabyte-drivers-elevation-privilege-vulnerabilities","tags":["Broken Link","Exploit","Third Party Advisory"]},{"url":"http://seclists.org/fulldisclosure/2018/Dec/39","tags":["Exploit","Mailing List","Third Party Advisory"]},{"url":"http://www.securityfocus.com/bid/106252","tags":["Broken Link","Third Party Advisory","VDB Entry"]},{"url":"https://www.gigabyte.com/Support/Security/1801","tags":["Vendor Advisory"]},{"url":"https://www.secureauth.com/labs/advisories/gigabyte-drivers-elevation-privilege-vulnerabilities","tags":["Broken Link","Exploit","Third Party Advisory"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2018-19321","tags":["US Government Resource"]}],"techniques":[{"id":"T1068","name":"Exploitation for Privilege Escalation","tactics":["privilege-escalation"],"provenance":"ai","basis":"ai-mapping","bases":["ai-mapping"],"basisDetail":"claude-haiku-5-5: local driver abuse for privilege escalation","mappingType":"exploitation_technique","evidence":[{"from":"description","quote":"expose functionality to read and write arbitrary physical memory","start":174,"end":238}],"model":"claude-haiku-5-5","confidence":"medium","confidenceNote":"AI-mapped from the description (quote-validated, not expert-reviewed)"}],"reports":[],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2018-11019","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2018-11019","exploited":true,"exploitedSince":"2022-10-24","provenance":"source"},"exploits":[],"exploitSources":{"pocGithub":{"count":2,"skipped":0,"earliest":"2022-04-26","earliestUrl":"https://github.com/nanabingies/Driver-RW","repos":[{"name":"nanabingies/Driver-RW","url":"https://github.com/nanabingies/Driver-RW","stars":8,"created":"2022-04-26"},{"name":"nanabingies/CVE-2018-19321","url":"https://github.com/nanabingies/CVE-2018-19321","stars":2,"created":"2023-01-07"}]},"first":{"date":"2022-04-26","source":"PoC-in-GitHub","url":"https://github.com/nanabingies/Driver-RW"},"provenance":"source"},"exploitRefs":["http://seclists.org/fulldisclosure/2018/Dec/39","https://www.secureauth.com/labs/advisories/gigabyte-drivers-elevation-privilege-vulnerabilities"],"flow":[{"stage":"exploitation","techniques":["T1068"],"provenance":"ai"}],"timeline":[{"date":"2018-12-21","kind":"published","label":"Published (NVD)","url":"https://nvd.nist.gov/vuln/detail/CVE-2018-19321","provenance":"source"},{"date":"2022-04-26","kind":"exploit-public","label":"First public exploit: PoC-in-GitHub","url":"https://github.com/nanabingies/Driver-RW","provenance":"source"},{"date":"2022-10-24","kind":"exploited-reported","label":"Exploitation first reported (VulnCheck KEV evidence)","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","provenance":"source"},{"date":"2022-10-24","kind":"kev","label":"Added to CISA KEV (known ransomware use)","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","provenance":"source"},{"date":"2022-10-24","kind":"euvd-exploited","label":"ENISA EUVD: exploited","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2018-11019","provenance":"source"}],"speed":{"daysToPublicExploit":1222,"firstExploitFrom":"PoC-in-GitHub","daysToKev":1403},"priority":{"score":76.4,"factors":[{"name":"In a KEV catalog","points":35.0,"detail":"listed in CISA KEV and VulnCheck KEV"},{"name":"Recent KEV listing","points":0.0,"detail":"added 1466 days ago"},{"name":"Known ransomware use","points":10.0,"detail":"CISA KEV and VulnCheck KEV: Known"},{"name":"EPSS percentile","points":17.94,"detail":"percentile 0.8970"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":5.0,"detail":"2 NVD references tagged Exploit; 2 PoC-in-GitHub repos"},{"name":"Mentioned in OTX pulses","points":3.0,"detail":"50 pulses"},{"name":"CVSS severity","points":5.46,"detail":"base score 7.8"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]}}