CVE-2018-19323 GIGABYTE Multiple Products Privilege Escalation

Exploited in the wild Critical 9.8 Published 21 Dec 2018 Updated 1 Oct 2026

A low-level driver in GIGABYTE utilities allows reading and writing Machine Specific Registers, enabling local privilege escalation.

Exploited in the wild: Since 24 Oct 2022
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2018-19323?

CVE-2018-19323 is a critical vulnerability in n/a, published on 21 Dec 2018. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

The GDrv low-level driver in GIGABYTE APP Center v1.05.21 and earlier, AORUS GRAPHICS ENGINE before 1.57, XTREME GAMING ENGINE before 1.26, and OC GURU II v2.08 exposes functionality to read and write Machine Specific Registers (MSRs).

Which versions are affected by CVE-2018-19323?

It affects 4 products.

Products include Gigabyte Aorus Graphics Engine, Gigabyte Gigabyte App Center, Gigabyte Oc Guru Ii, Gigabyte Xtreme Gaming Engine.

How do I fix CVE-2018-19323?

No fix has been published for CVE-2018-19323 yet. Limit exposure of the affected software until one is available. US federal agencies must fix it by 14 Nov 2022.

Is CVE-2018-19323 being exploited?

Yes. Attackers have exploited CVE-2018-19323 in the wild since at least 24 Oct 2022, including in ransomware campaigns.

Public exploit code: 1 proofs of concept on GitHub.

Sources

Also known as GHSA-237x-ggj9-vvhf.