CVE-2018-19320: GIGABYTE GDrv driver exposes ring0 memory write to local attackers

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: high.

high priorityIt is in CISA KEV with a ransomware campaign flag and gives full system control, but exploitation requires local access and the EPSS score is modest.

What it is

The GDrv low-level driver shipped with GIGABYTE APP Center, AORUS GRAPHICS ENGINE, XTREME GAMING ENGINE and OC GURU II exposes memcpy-like functionality that runs at ring0. Any local user who can reach the driver interface can abuse that primitive to overwrite kernel memory and take full control of the machine.

Impact

An attacker gains kernel-level read/write, which converts a normal user session into complete control of the affected system, including the ability to disable protections and persist.

Attack surface

Reached locally through the installed GIGABYTE driver interface; the CVSS vector is AV:L/PR:L/UI:N, so a low-privileged local account is required and no user interaction is needed. No remote or network path is described.

Exploitation

CISA added it to KEV on 2022-10-24 with a known ransomware campaign flag, and public exploit references exist, though EPSS 30-day probability is only about 3.6 percent.

What to do

• Apply the vendor updates listed on GIGABYTE's security advisory page for APP Center, AORUS GRAPHICS ENGINE, XTREME GAMING ENGINE and OC GURU II.
• If patching is not immediately possible, remove or disable the GDrv driver and the associated GIGABYTE utilities on systems that do not need them.
• Restrict local interactive logon and administrative rights so untrusted users cannot run code on hosts carrying the driver.
• Monitor for reinstallation of the vulnerable utilities by users or software deployment after remediation.

Detection

• Hunt for the GDrv driver file and GIGABYTE utility install paths on endpoints and flag hosts still running them.
• Alert on driver load events for GDrv.sys and on unexpected processes opening a handle to that device.
• Correlate local privilege-escalation behavior, such as a non-system process writing to kernel memory or loading unsigned drivers, with GIGABYTE utility presence.
• Review EDR telemetry for known exploit tooling that targets this driver family.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.