CVE-2018-19320

HighCVSS 7.8/10Known exploited (CISA KEV)Last modified Aug 13, 2026

Description

The GDrv low-level driver in GIGABYTE APP Center v1.05.21 and earlier, AORUS GRAPHICS ENGINE before 1.57, XTREME GAMING ENGINE before 1.26, and OC GURU II v2.08 exposes ring0 memcpy-like functionality that could allow a local attacker to take complete control of the affected system.

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://seclists.org/fulldisclosure/2018/Dec/39Exploit, Mailing List, Third Party Advisory
http://www.securityfocus.com/bid/106252Broken Link, Third Party Advisory, VDB Entry
https://www.gigabyte.com/Support/Security/1801Vendor Advisory
https://www.gigabyte.com/tw/Support/Utility/Graphics-CardProduct
https://www.secureauth.com/labs/advisories/gigabyte-drivers-elevation-privilege-vulnerabilitiesBroken Link, Exploit, Third Party Advisory
http://seclists.org/fulldisclosure/2018/Dec/39Exploit, Mailing List, Third Party Advisory
http://www.securityfocus.com/bid/106252Broken Link, Third Party Advisory, VDB Entry
https://www.gigabyte.com/Support/Security/1801Vendor Advisory
https://www.gigabyte.com/tw/Support/Utility/Graphics-CardProduct
https://www.secureauth.com/labs/advisories/gigabyte-drivers-elevation-privilege-vulnerabilitiesBroken Link, Exploit, Third Party Advisory
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2018-19320US Government Resource

Timeline

Published: Dec 21, 2018
Last modified: Aug 13, 2026
Added to CISA KEV: Oct 24, 2022
NVD status: Analyzed

Related CVEs from 2018

CVE-2018-193217.8The GPCIDrv and GDrv low-level drivers in GIGABYTE APP Center v1.05.21 and earlier, AORUS GRAPHICS ENGINE before 1.57, XTREME GAMING ENGINE CVE-2018-193227.8The GPCIDrv and GDrv low-level drivers in GIGABYTE APP Center v1.05.21 and earlier, AORUS GRAPHICS ENGINE before 1.57, XTREME GAMING ENGINE CVE-2018-193239.8The GDrv low-level driver in GIGABYTE APP Center v1.05.21 and earlier, AORUS GRAPHICS ENGINE before 1.57, XTREME GAMING ENGINE before 1.26, CVE-2018-193245.4kimsQ Rb 2.3.0 allows XSS via the second input field to the /?r=home&mod=mypage&page=info URI.CVE-2018-193267.5Zyxel VMG1312-B10D devices before 5.13(AAXA.8)C0 allow ../ Directory Traversal, as demonstrated by reading /etc/passwd.CVE-2018-193278.8An issue was discovered in JTBC(PHP) 3.0.1.7. aboutus/manage.php?type=action&action=add allows CSRF.CVE-2018-193289.8LAOBANCMS 2.0 allows install/mysql_hy.php?riqi=../ Directory Traversal.CVE-2018-193294.9GreenCMS v2.3.0603 allows remote authenticated administrators to delete arbitrary files by modifying a base64-encoded pathname in an m=admin CVE-2018-19335.4IBM Planning Analytics 2.0 through 2.0.6 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScrip CVE-2018-193317.5An issue was discovered in S-CMS v1.5. There is a SQL injection vulnerability in search.php via the keyword parameter.CVE-2018-193328.8An issue was discovered in S-CMS v1.5. There is a CSRF vulnerability that can add a new user via the admin/ajax.php?type=member&action=add U CVE-2018-193339.8pkg/sentry/kernel/shm/shm.go in Google gVisor before 2018-11-01 allows attackers to overwrite memory locations in processes running as root