Motherboard utility software has a long habit of shipping kernel drivers that are more trusting than they should be, and GIGABYTE has been here before. The company has posted a new security advisory, and if Control Center is installed on your PC, updating it should be on today’s to-do list.
GIGABYTE’s advisory, listed on its security advisory page, covers a pair of kernel drivers, GVCIDrv64.sys and gdrv3.sys, which are components of the GIGABYTE Control Center (GCC) software. The company says flaws in the drivers’ IOCTL interfaces, caused by insufficient access control and improper input validation, let authenticated local attackers perform unauthorized operations, including arbitrary physical memory mapping and direct hardware access. In GIGABYTE’s own words, that can mean “complete system compromise (achieving NT AUTHORITY\SYSTEM).”
The fix is already out. Any GCC version from 26.08.28.01 or GBT_VGA_26.08.24.01 onward includes the mitigation, and the current release appears to be 26.09.10.01. The changes include strict security descriptors on the driver device objects, removal of high-risk physical memory mapping interfaces, mandatory privilege checks, and rigorous IOCTL input validation. The “GBT_VGA” build string means graphics card owners using GIGABYTE’s utility, like the one bundled with the card in our GIGABYTE RTX 5090 GAMING OC review, should check too.
How to check if you’re affected: Open GIGABYTE Control Center and look at its version in the settings or about panel. Anything older than the builds above needs updating from GIGABYTE’s official utility page. To see whether the drivers are present at all, run this in an admin PowerShell window: Get-CimInstance Win32_SystemDriver | Where-Object { $_.PathName -match 'gdrv3|GVCIDrv64' }. If it returns nothing, those drivers aren’t loaded on your system.
This is a local privilege escalation, so an attacker already needs a foothold on your machine. But that’s exactly how vulnerable signed drivers get abused: malware lands as a normal user, then leans on a trusted kernel driver to disable security tools. GIGABYTE’s older gdrv.sys is already a known offender. It’s listed on the LOLDrivers project for multiple 2018 CVEs allowing physical memory read/write and ring0 memcpy-like functionality. This is also GCC’s second security scare this year. In March, GIGABYTE patched CVE-2026-4415, a critical flaw in Control Center’s pairing feature that let remote unauthenticated attackers write arbitrary files.
Our take: update, and ask whether you need GCC at all. If you only installed it for RGB or fan curves you set once, uninstalling it removes the attack surface entirely. Either way, download it only from GIGABYTE’s site.
Discussion
Join Discussion →No replies yet. Be the first to reply on the forum.