CVE-2026-9492 is an improper access control vulnerability in the MBStorage DRAM lighting control module of Gigabyte Control Center. Authenticated local attackers can send specific IOCTL commands via the MyPortIO_x64.sys driver, allowing arbitrary physical memory read/write and kernel-level privilege escalation. The vulnerability has a high severity score of 8.5. No patch or official remediation has been confirmed yet.
CVE-2026-4416 is a high-severity vulnerability in the Performance Library component of the Gigabyte Control Center. It involves insecure deserialization of untrusted data, allowing authenticated local attackers to send malicious serialized payloads to the EasyTune Engine service. Successful exploitation can lead to privilege escalation on the affected system. There is no information about an available patch or vendor advisory at this time. The vulnerability requires local authentication and does not involve user interaction.
CVE-2026-4415 is a critical vulnerability in GIGABYTE's Gigabyte Control Center that allows unauthenticated remote attackers to write arbitrary files to any location on the operating system when the pairing feature is enabled. This arbitrary file write can lead to arbitrary code execution or privilege escalation. The vulnerability is classified as a relative path traversal (CWE-23). It has a high CVSS 4.0 score of 9.2, indicating a severe risk. No official patch or remediation information is currently provided. There are no known exploits in the wild at this time.
CVE-2026-0870 is a high-severity local privilege escalation vulnerability in GIGABYTE's MacroHub application. The flaw arises because MacroHub launches external applications with excessive privileges, allowing an authenticated local attacker to execute arbitrary code with SYSTEM-level privileges. This vulnerability requires local access and no user interaction, but only low complexity to exploit. Although no known exploits are currently reported in the wild, the impact on confidentiality, integrity, and availability is high due to SYSTEM-level code execution. European organizations using GIGABYTE hardware with MacroHub installed could be at risk, especially in sectors with high reliance on GIGABYTE products. Mitigation involves applying patches once available, restricting local user permissions, and monitoring for suspicious local activity. Countries with significant GIGABYTE market penetration and critical infrastructure sectors, such as Germany, France, and the UK, are most likely affected. Defenders should prioritize vulnerability scanning and restrict local access to trusted users to reduce risk.
Certain motherboard models developed by GIGABYTE has a Protection Mechanism Failure vulnerability. Because IOMMU was not properly enabled, unauthenticated physical attackers can use a DMA-capable PCIe device to read and write arbitrary physical memory before the OS kernel and its security features are loaded.
A vulnerability in the Software SMI handler (SwSmiInputValue 0xB2) allows a local attacker to control the RBX register, which is used as an unchecked pointer in the CommandRcx0 function. If the contents at RBX match certain expected values (e.g., '$DB$' or '2DB$'), the function performs arbitrary writes to System Management RAM (SMRAM), leading to potential privilege escalation to System Management Mode (SMM) and persistent firmware compromise.
A vulnerability in the Software SMI handler (SwSmiInputValue 0x20) allows a local attacker to supply a crafted pointer (FuncBlock) through RBX and RCX register values. This pointer is passed unchecked into multiple flash management functions (ReadFlash, WriteFlash, EraseFlash, and GetFlashInfo) that dereference both the structure and its nested members, such as BufAddr. This enables arbitrary read/write access to System Management RAM (SMRAM), allowing an attacker to corrupt firmware memory, exfiltrate SMRAM content via flash, or install persistent implants.
A vulnerability in the Software SMI handler (SwSmiInputValue 0xB2) allows a local attacker to control both the read and write addresses used by the CommandRcx1 function. The write target is derived from an unvalidated UEFI NVRAM variable (SetupXtuBufferAddress), while the write content is read from an attacker-controlled pointer based on the RBX register. This dual-pointer dereference enables arbitrary memory writes within System Management RAM (SMRAM), leading to potential SMM privilege escalation and firmware compromise.
A vulnerability in the Software SMI handler (SwSmiInputValue 0xB2) allows a local attacker to control the RBX register, which is used to derive pointers (OcHeader, OcData) passed into power and thermal configuration logic. These buffers are not validated before performing multiple structured memory writes based on OcSetup NVRAM values, enabling arbitrary SMRAM corruption and potential SMM privilege escalation.
Multiple GIGABYTE products including GIGABYTE App Center, AORUS Graphics Engine, XTREME Gaming Engine, and OC GURU contain low-level driver vulnerabilities that allow local attackers to read and write arbitrary physical memory. This flaw enables privilege escalation on affected systems. The vulnerability is known to be exploited in the wild and has been used in ransomware campaigns.
Multiple GIGABYTE products including GIGABYTE App Center, AORUS Graphics Engine, XTREME Gaming Engine, and OC GURU II contain low-level driver vulnerabilities (GPCIDrv and GDrv) that allow reading and writing to IO ports. This flaw can be exploited to execute code with elevated privileges. The vulnerability has been exploited in the wild and is associated with known ransomware campaigns.
Multiple GIGABYTE products including GIGABYTE App Center, AORUS Graphics Engine, XTREME Gaming Engine, and OC GURU II contain low-level driver vulnerabilities that allow local attackers to read and write arbitrary physical memory, enabling privilege escalation. This vulnerability has been exploited in the wild and is associated with known ransomware campaigns.
CVE-2018-19320 is a high-severity vulnerability affecting multiple GIGABYTE products including GIGABYTE App Center, AORUS Graphics Engine, XTREME Gaming Engine, and OC GURU II. The vulnerability arises from the GDrv low-level driver exposing ring0 memcpy-like functionality, which could allow a local attacker to gain complete control over the affected system. This vulnerability has been exploited in the wild and is known to have been used in ransomware campaigns. No specific affected versions or patch information is provided in the available data.
