CVE Watch13 ago 2026

CVE-2018-19322

GIGABYTE Multiple Products Code Execution Vulnerability

CVSS

7.8

Alto

EPSS

1.8%

p77

KEV

SÍ

24 oct 2022

Exploit Today

0-100

Publicado: 21 dic 2018 · Última mod.: 13 ago 2026 · CWE-749

EPSS · 30d

1.8%EPSS · 30 días1.9%

2026-08-022026-08-31

Ficha del catálogo KEV

Producto

GIGABYTE / Multiple Products

Vulnerabilidad

GIGABYTE Multiple Products Code Execution Vulnerability

Añadido a KEV

24 oct 2022

Remediar antes de

14 nov 2022

Uso conocido en ransomware

Sí

Descripción resumida

The GPCIDrv and GDrv low-level drivers in GIGABYTE App Center, AORUS Graphics Engine, XTREME Gaming Engine, and OC GURU II expose functionality to read/write data from/to IO ports. This could be leveraged in a number of ways to ultimately run code with elevated privileges.

Acción requerida

Apply updates per vendor instructions.

Notas

https://www.gigabyte.com/Support/Security/1801; https://nvd.nist.gov/vuln/detail/CVE-2018-19322

Descripción técnica

The GPCIDrv and GDrv low-level drivers in GIGABYTE APP Center v1.05.21 and earlier, AORUS GRAPHICS ENGINE before 1.57, XTREME GAMING ENGINE before 1.26, and OC GURU II v2.08 expose functionality to read/write data from/to IO ports. This could be leveraged in a number of ways to ultimately run code with elevated privileges.

Referencias oficiales

CVEs relacionados

CVECVSSEPSSKEVRExplotTítuloVis.

CVE-2026-182637.8 ALT

3.1%

——1Parallels RAS Client RDP Backend Service Exposed Dangerous Function Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of Parallels RAS Client. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within the RAS RDP Backend Service. The issue results from an exposed dangerous function. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of SYSTEM. Was ZDI-CAN-28886.5d CVE-2026-182627.8 ALT

2.9%

23.4%

——7Streambert is a cross-platform Electron Desktop App to stream and download video content. Prior to version 2.6.0, the open-external IPC handler in src/ipc/downloads.js passes a renderer-supplied url directly to Electron's shell.openExternal without validating its protocol. A compromised renderer can submit file: URIs or operating-system-specific custom schemes, causing the host to open local files, access remote resources through registered handlers, or launch scripts and applications supported by those handlers. This issue is fixed in version 2.6.0.12d CVE-2026-4805610.0 CRÍ

30.9%

——9Streambert is a cross-platform Electron Desktop App to stream and download video content. Versions prior to 2.5.0 improperly validate executable paths supplied to the run-download IPC handler, allowing a compromised renderer process to execute arbitrary local binaries with the application’s privileges. Version 2.5.0 contains a patch.20d CVE-2026-688239.1 CRÍ

46.5%

——14Exposed dangerous method or function in Azure Confidential Ledger allows an authorized attacker to execute code over a network.24d