CVE-2011-2005: Microsoft Windows afd.sys input validation privilege escalation

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: high.

high priorityThe vulnerability is in CISA KEV with high EPSS and allows full kernel privilege escalation, though it requires local access and user interaction on legacy systems.

What it is

The Ancillary Function Driver (afd.sys) in Windows XP SP2/SP3 and Server 2003 SP2 fails to properly validate user-mode input passed to kernel mode. A local attacker can exploit this to elevate privileges to kernel level. The flaw is old but is listed in CISA KEV, so it remains relevant for unpatched legacy systems.

Impact

An attacker who can run code on the host gains kernel-level privileges, allowing full control of the affected system. This can lead to credential theft, disabling of security controls, and further lateral movement.

Attack surface

The vulnerability is local (AV:L) and requires user interaction (UI:R), meaning an attacker must already have a foothold or convince a user to run a crafted application. No authentication is needed beyond local access.

Exploitation

CVE-2011-2005 is in CISA KEV (added 2022-03-28) and has a high EPSS probability of 0.318 (98th percentile), indicating active exploitation in the wild. No ransomware campaign use is documented.

What to do

• Apply the Microsoft security update MS11-080 immediately on affected Windows XP and Server 2003 systems.
• If patching is not possible, isolate or decommission legacy XP/2003 hosts from untrusted networks.
• Restrict local interactive logon and application execution to trusted users only.
• Monitor for and block execution of untrusted binaries that attempt to interact with afd.sys.
• Migrate remaining workloads off Windows XP and Server 2003 to supported operating systems.

Detection

• Monitor for suspicious local process creation events that load or interact with afd.sys unexpectedly.
• Audit Windows Security logs for privilege escalation attempts or token manipulation on legacy hosts.
• Use EDR to detect crafted applications exploiting kernel input validation flaws in afd.sys.
• Check for known exploit artifacts or unusual child processes spawned from user-writable directories on XP/2003 systems.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.