The Gigabyte BIOS utility includes a signed kernel driver, GVCIDrv64.sys, which creates a device interface without security descriptors, allowing any local user to open it without administrative privileges or UAC prompts. The driver exposes three IOCTLs with no access control: mapping 32 MB of physical memory, unmapping it, and raw I/O port read/write. By rewriting a PCI device's BAR0 register to point to arbitrary physical memory and then mapping it, an attacker gains arbitrary physical memory read/write capabilities. This is combined with raw I/O port access to manipulate system memory safely. The exploit reads the System process token and overwrites the attacker's process token to escalate privileges to SYSTEM. The vulnerability was reported to Gigabyte in June 2026, who removed the vulnerable driver and replaced it with GvVbiosDrv64.sys in version GBT_VGA_26.08.24.01 of their BIOS utility.

An unprivileged local user can gain arbitrary physical memory read/write and I/O port access, enabling privilege escalation to SYSTEM on affected Windows 10 x64 systems. This allows full system compromise without kernel memory corruption or mitigations. The exploit requires disabling the network adapter to avoid system crashes during BAR0 manipulation and is limited to systems with ≤4 GB physical memory due to 32-bit BAR0 addressing.

Gigabyte has removed the vulnerable GVCIDrv64.sys driver and replaced it with GvVbiosDrv64.sys in BIOS utility version GBT_VGA_26.08.24.01. Users should update to this version or later to eliminate the vulnerable driver. No other mitigation is required as the vulnerable driver is no longer present in updated utilities.