{"id":"CVE-2018-19322","published":"2018-12-21T23:29:00Z","modified":"2026-08-13T05:17:16Z","title":"GIGABYTE Multiple Products Code Execution Vulnerability","vendor":"GIGABYTE","product":"Multiple Products","tier":"core","eol":null,"description":{"text":"The GPCIDrv and GDrv low-level drivers in GIGABYTE APP Center v1.05.21 and earlier, AORUS GRAPHICS ENGINE before 1.57, XTREME GAMING ENGINE before 1.26, and OC GURU II v2.08 expose functionality to read/write data from/to IO ports. This could be leveraged in a number of ways to ultimately run code with elevated privileges.","provenance":"source","from":"NVD"},"summary":{"text":"The GPCIDrv and GDrv low-level drivers shipped with GIGABYTE APP Center (v1.05.21 and earlier), AORUS GRAPHICS ENGINE (before 1.57), XTREME GAMING ENGINE (before 1.26), and OC GURU II (v2.08) expose functionality that reads and writes data to IO ports. An attacker with local access and low-privileged credentials, and no user interaction required, can abuse this exposed driver functionality to ultimately run code with elevated privileges.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-23T07:05:13Z"},"cvss":{"score":7.8,"severity":"HIGH","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","provenance":"source","from":"NVD"},"epss":{"score":0.01816,"percentile":0.7861,"date":"2026-10-28","provenance":"source"},"kev":{"dateAdded":"2022-10-24","dueDate":"2022-11-14","ransomware":true,"requiredAction":"Apply updates per vendor instructions.","notes":"https://www.gigabyte.com/Support/Security/1801; https://nvd.nist.gov/vuln/detail/CVE-2018-19322","provenance":"source"},"vulncheckKev":{"dateAdded":"2022-10-24","exploitedFirstSeen":"2022-10-24","ransomware":true,"evidence":[{"url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","date":"2022-10-24"},{"url":"https://info.securin.io/hubfs/Securin%20Ransomware%20Report%202023.pdf","date":"2023-02-14"},{"url":"https://bi.zone/upload/for_download/Threat_Zone_2025_BI.ZONE_Research_rus.pdf","date":"2025-04-08"}],"evidenceTotal":3,"provenance":"source"},"exploited":true,"otx":{"pulseCount":50,"pulses":[{"name":"Actively_Exploited_Kev | Oct 29, 2026","url":"https://otx.alienvault.com/pulse/6ae20c1db17e7057ae7d9ad1","created":"2026-10-28"},{"name":"Actively_Exploited_Kev | Oct 28, 2026","url":"https://otx.alienvault.com/pulse/6ae0ba7e0e2a97ff7b218819","created":"2026-10-27"},{"name":"Actively_Exploited_Kev | Oct 27, 2026","url":"https://otx.alienvault.com/pulse/6adf68b85c3e852f3c111d18","created":"2026-10-26"},{"name":"Actively_Exploited_Kev | Oct 24, 2026","url":"https://otx.alienvault.com/pulse/6adb740e397c3ad4799aa4cd","created":"2026-10-23"},{"name":"Actively_Exploited_Kev | Oct 23, 2026","url":"https://otx.alienvault.com/pulse/6ada236fcfba2dfa730ea482","created":"2026-10-22"},{"name":"Actively_Exploited_Kev | Oct 22, 2026","url":"https://otx.alienvault.com/pulse/6ad8d33a077cbb5cab524d80","created":"2026-10-21"},{"name":"Actively_Exploited_Kev | Oct 21, 2026","url":"https://otx.alienvault.com/pulse/6ad78130c4d1ac2be83a8b6d","created":"2026-10-20"},{"name":"Actively_Exploited_Kev | Oct 20, 2026","url":"https://otx.alienvault.com/pulse/6ad62f63c24a405a3423cc13","created":"2026-10-19"},{"name":"Actively_Exploited_Kev | Oct 19, 2026","url":"https://otx.alienvault.com/pulse/6ad4dda174e5797d0bd238b7","created":"2026-10-18"},{"name":"Actively_Exploited_Kev | Oct 18, 2026","url":"https://otx.alienvault.com/pulse/6ad38c22e1848f8189d1c121","created":"2026-10-17"}],"provenance":"machine"},"cwes":[{"id":"CWE-749","name":"Exposed Dangerous Method or Function"}],"references":[{"url":"http://seclists.org/fulldisclosure/2018/Dec/39","tags":["Exploit","Mailing List","Third Party Advisory"]},{"url":"http://www.securityfocus.com/bid/106252","tags":["Broken Link","Third Party Advisory","VDB Entry"]},{"url":"https://www.gigabyte.com/Support/Security/1801","tags":["Vendor Advisory"]},{"url":"https://www.gigabyte.com/tw/Support/Utility/Graphics-Card","tags":["Product"]},{"url":"https://www.secureauth.com/labs/advisories/gigabyte-drivers-elevation-privilege-vulnerabilities","tags":["Broken Link","Exploit","Third Party Advisory"]},{"url":"http://seclists.org/fulldisclosure/2018/Dec/39","tags":["Exploit","Mailing List","Third Party Advisory"]},{"url":"http://www.securityfocus.com/bid/106252","tags":["Broken Link","Third Party Advisory","VDB Entry"]},{"url":"https://www.gigabyte.com/Support/Security/1801","tags":["Vendor Advisory"]},{"url":"https://www.gigabyte.com/tw/Support/Utility/Graphics-Card","tags":["Product"]},{"url":"https://www.secureauth.com/labs/advisories/gigabyte-drivers-elevation-privilege-vulnerabilities","tags":["Broken Link","Exploit","Third Party Advisory"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2018-19322","tags":["US Government Resource"]}],"techniques":[{"id":"T1068","name":"Exploitation for Privilege Escalation","tactics":["privilege-escalation"],"provenance":"ai","basis":"ai-mapping","bases":["ai-mapping"],"basisDetail":"claude-haiku-5-5: Local driver flaw enables privilege escalation to elevated execution","mappingType":"exploitation_technique","evidence":[{"from":"description","quote":"expose functionality to read/write data from/to IO ports","start":174,"end":230}],"model":"claude-haiku-5-5","confidence":"medium","confidenceNote":"AI-mapped from the description (quote-validated, not expert-reviewed)"},{"id":"T1082","name":"System Information Discovery","tactics":["discovery"],"provenance":"ai","basis":"ai-mapping","bases":["ai-mapping"],"basisDetail":"claude-haiku-5-5: Direct port I/O access from user mode","mappingType":"primary_impact","evidence":[{"from":"description","quote":"expose functionality to read/write data from/to IO ports","start":174,"end":230}],"model":"claude-haiku-5-5","confidence":"medium","confidenceNote":"AI-mapped from the description (quote-validated, not expert-reviewed)"}],"reports":[],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2018-11020","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2018-11020","exploited":true,"exploitedSince":"2022-10-24","provenance":"source"},"exploits":[],"exploitSources":null,"exploitRefs":["http://seclists.org/fulldisclosure/2018/Dec/39","https://www.secureauth.com/labs/advisories/gigabyte-drivers-elevation-privilege-vulnerabilities"],"flow":[{"stage":"exploitation","techniques":["T1068"],"provenance":"ai"},{"stage":"primary","techniques":["T1082"],"provenance":"ai"}],"timeline":[{"date":"2018-12-21","kind":"published","label":"Published (NVD)","url":"https://nvd.nist.gov/vuln/detail/CVE-2018-19322","provenance":"source"},{"date":"2022-10-24","kind":"exploited-reported","label":"Exploitation first reported (VulnCheck KEV evidence)","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","provenance":"source"},{"date":"2022-10-24","kind":"kev","label":"Added to CISA KEV (known ransomware use)","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","provenance":"source"},{"date":"2022-10-24","kind":"euvd-exploited","label":"ENISA EUVD: exploited","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2018-11020","provenance":"source"}],"speed":{"daysToPublicExploit":null,"firstExploitFrom":null,"daysToKev":1403},"priority":{"score":74.2,"factors":[{"name":"In a KEV catalog","points":35.0,"detail":"listed in CISA KEV and VulnCheck KEV"},{"name":"Recent KEV listing","points":0.0,"detail":"added 1466 days ago"},{"name":"Known ransomware use","points":10.0,"detail":"CISA KEV and VulnCheck KEV: Known"},{"name":"EPSS percentile","points":15.72,"detail":"percentile 0.7861"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":5.0,"detail":"2 NVD references tagged Exploit"},{"name":"Mentioned in OTX pulses","points":3.0,"detail":"50 pulses"},{"name":"CVSS severity","points":5.46,"detail":"base score 7.8"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]}}