# CVE-2018-19323

The GDrv low-level driver in GIGABYTE APP Center v1.05.21 and earlier, AORUS GRAPHICS ENGINE before 1.57, XTREME GAMING ENGINE before 1.26, and OC GURU II v2.08 exposes functionality to read and write Machine Specific Registers (MSRs).

- Page: https://www.vulneraibility.com/cve/CVE-2018-19323
- CVSS: 9.8
- Known exploited: yes, in CISA KEV since 2022-10-24; CISA due date 2022-11-14; known ransomware use
- EPSS: 8.36% (percentile 95.0)
- Unvetted proof-of-concept code on GitHub: 1 GitHub proof of concept (first 2025-08-27)
- CISA SSVC: exploitation active, automatable no, technical impact total (assessed 2026-08-13)
- Published: 2018-12-21

## Affected

- gigabyte:aorus_graphics_engine
- gigabyte:gigabyte_app_center
- gigabyte:oc_guru_ii
- gigabyte:xtreme_gaming_engine

## References

- [other] http://seclists.org/fulldisclosure/2018/Dec/39
- [other] https://www.secureauth.com/labs/advisories/gigabyte-drivers-elevation-privilege-vulnerabilities
- [other] http://www.securityfocus.com/bid/106252
- [other] https://www.gigabyte.com/tw/Support/Utility/Graphics-Card
- [other] https://www.gigabyte.com/Support/Security/1801
- [other] https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2018-19323

---
Summary, impact and action are written by the vulneraibility.com AI analysis pipeline from the CVE record, NVD, CISA and FIRST data; verify against the references.