CVE-2018-19322: GIGABYTE driver IO port access allows privilege escalation

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: high.

high priorityThe vulnerability is in CISA KEV with known ransomware use and allows local privilege escalation to full system control, though it requires local access and low privileges to trigger.

What it is

The GPCIDrv and GDrv low-level drivers shipped with GIGABYTE APP Center, AORUS GRAPHICS ENGINE, XTREME GAMING ENGINE and OC GURU II expose IO port read/write functionality to user-mode callers. Because this primitive is not properly restricted, an attacker can abuse it to run code with elevated privileges. The flaw affects multiple widely installed GIGABYTE utilities, so it is relevant to any endpoint with those tools present.

Impact

An attacker who can execute code on the host gains kernel-level or SYSTEM privileges, enabling full control of the machine, persistence and disabling of security controls.

Attack surface

Reached locally through the vulnerable driver interface; the CVSS vector indicates low privileges are required and no user interaction is needed. No remote or network vector is described.

Exploitation

CVE-2018-19322 is listed in CISA KEV with a due date of 2022-11-14 and is flagged for known ransomware campaign use; EPSS 30-day probability is about 1.8 percent (77th percentile). Public exploit references exist in the advisory and mailing list entries.

What to do

• Apply the vendor updates referenced in GIGABYTE's security advisory (https://www.gigabyte.com/Support/Security/1801) and upgrade the affected utilities to fixed versions.
• If patching is not immediately possible, remove or disable the GIGABYTE APP Center, AORUS GRAPHICS ENGINE, XTREME GAMING ENGINE and OC GURU II software and their drivers from endpoints that do not require them.
• Restrict local administrative rights and monitor for non-admin processes loading GPCIDrv or GDrv.
• Block or alert on driver load events for the affected driver files via application control or WDAC policies.

Detection

• Hunt for driver load events (Sysmon Event ID 6) referencing GPCIDrv or GDrv, especially from non-standard or user-writable paths.
• Monitor for processes that load the vulnerable drivers and subsequently perform privileged operations or spawn elevated children.
• Alert on creation or modification of the affected GIGABYTE utility binaries and drivers on endpoints.
• Review endpoint inventory for installations of APP Center, AORUS GRAPHICS ENGINE, XTREME GAMING ENGINE and OC GURU II to scope exposure.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.