Actively exploited in the wild
GIGABYTE Multiple Products Unspecified Vulnerability
GIGABYTE - Multiple Products · Listed in the CISA KEV since 2022-10-24. This indicates confirmed attacks in production environments.
Required action: Apply updates per vendor instructions.
CVE-2018-19320
HighCVSS 7.8KEVExploitation Probability (EPSS)
High risk88th percentile - higher than 88% of all known CVEs
Summary
The GDrv low-level driver in GIGABYTE APP Center and other tools exposes ring0 memcpy-like functionality that could allow a local attacker to take complete control of the affected system.
Risk Assessment
An attacker could gain full control of the system, potentially leading to data theft, malware installation, and service disruption.
Recommendation
Update GIGABYTE software to versions that fix this driver, or consider removing unnecessary tools.
Original NVD description (English source)
The GDrv low-level driver in GIGABYTE APP Center v1.05.21 and earlier, AORUS GRAPHICS ENGINE before 1.57, XTREME GAMING ENGINE before 1.26, and OC GURU II v2.08 exposes ring0 memcpy-like functionality that could allow a local attacker to take complete control of the affected system.