Microsoft Windows Ancillary Function Driver (afd.sys) Local Privilege Escalation Vulnerability (CVE-2011-2005, MS11-080)
Executive & SecOps Summary
SECOPS ASSESSMENTMicrosoft Windows XP SP2/SP3 and Windows Server 2003 SP2.
Local attackers can execute arbitrary code in kernel mode and gain elevated SYSTEM privileges via a crafted application.
Apply the official Microsoft MS11-080 security patch, or restrict local execution privileges and isolate legacy systems.
Affected Products & Version Scope
Remediation & Live Workaround Commands
PATCH & WORKAROUND1. Official Patch & Version Upgrade Commands
This vulnerability is addressed in the MS11-080 security bulletin. For legacy systems, verify the installation of the corresponding hotfix using the following command:
# Check if the MS11-080 patch (KB2566454) is installed
Get-HotFix -Id KB25664542. Temporary Workaround & Hardening Configuration
If patching is not immediately feasible, restrict local interactive login access and enforce Software Restriction Policies (SRP) to prevent unauthorized executable runs.
# Example: Restrict execution of untrusted binaries via Registry modification
New-Item -Path 'HKLM:\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Paths\{afd-prevent}' -Force
Set-ItemProperty -Path 'HKLM:\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Paths\{afd-prevent}' -Name 'SaferFlags' -Value 03. Log Audit & IoC Verification Commands
Verify the file version of afd.sys to determine if the system remains in a vulnerable state.
# Retrieve the file version of afd.sys
$sysPath = '[Environment]::SystemDirectory\drivers\afd.sys'
(Get-Item $sysPath).VersionInfo | Select-Object FileVersion, ProductVersionBlock Kernel Privilege Escalation & Ransomware Payloads Before You Can Reboot
Protect unpatched Windows, Linux, and macOS workloads against in-memory exploitation and lateral movement with autonomous EDR.
Technical Root Cause & Exploitation Mechanics
1. Vulnerability Overview & Root Cause
This vulnerability exists in afd.sys (Ancillary Function Driver), the kernel-mode driver responsible for managing Windows socket connections. The root cause is the driver's failure to properly validate user-mode input pointers passed into kernel space, leading to an arbitrary write condition within kernel memory.
2. Exploitation Mechanics & Attack Scenario
A local attacker with low privileges executes a specially crafted application that opens a handle to the \\Device\\Afd device and issues a specific DeviceIoControl request. Because afd.sys does not validate the input buffer addresses using proper probing mechanisms, the attacker can overwrite critical kernel structures, such as the token of the calling process, to escalate privileges to NT AUTHORITY\SYSTEM.
3. Infrastructure & Business Impact
As a vulnerability listed in the CISA KEV catalog, this flaw has been actively exploited in the wild. Successful exploitation allows an attacker who has established an initial foothold to gain full administrative control over the host. This enables evasion of endpoint security controls, deployment of persistent malware, and subsequent lateral movement across the enterprise network.
Official Vendor Advisories & References
afd.sys in the Ancillary Function Driver in Microsoft Windows XP SP2 and SP3 and Server 2003 SP2 does not properly validate user-mode input passed to kernel mode, which allows local users to gain privileges via a crafted application, aka "Ancillary Function Driver Elevation of Privilege Vulnerability."
Frequently Asked SecOps Questions (CVE-2011-2005)
FAQQ1. How critical is CVE-2011-2005 and is it actively exploited in the wild?
CVE-2011-2005 is rated CVSS 7.8 (HIGH) with a 30-day EPSS exploitation probability of 31.8%. It is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, requiring immediate emergency remediation.
Q2. Which vendors and products are affected by CVE-2011-2005?
Primary impacted vendors include microsoft across windows, windows_server. Scope summary: Microsoft Windows XP SP2 and SP3, and Windows Server 2003 SP2
Q3. What temporary mitigations or workarounds exist for CVE-2011-2005 before patching?
[Mitigation] Apply the official Microsoft MS11-080 security patch, or restrict local execution privileges and isolate legacy systems. Follow the CLI remediation commands and interactive SecOps checklist on this page to restrict exposure prior to your maintenance window.
Generate an Internal Engineering Notice or CISO Report for CVE-2011-2005
Instantly format this advisory into an executive CISO summary or engineering patch ticket.
🔗 Related Advisories in Similar Stack (microsoft)
View Category →Windows IKE Extension Double Free Remote Code Execution Vulnerability (CVE-2026-33824)
[Affected Scope] Internet Key Exchange (IKE) Extension service running on Microsoft Windows and Windows Server operating systems
Windows Remote Access Connection Manager (RasMan) Null Pointer Dereference Local DoS Vulnerability (CVE-2026-21525) Technical Advisory
[Affected Scope] Windows and Windows Server operating systems utilizing the Windows Remote Access Connection Manager (RasMan) service.
Windows ALPC Heap-Based Buffer Overflow Privilege Escalation Vulnerability (CVE-2026-85880) Security Advisory
[Affected Scope] Locally authenticated users across Microsoft Windows operating systems
Windows Update Stack Privilege Escalation Vulnerability via Link Following (CVE-2026-81963) Technical Advisory
[Affected Scope] Microsoft Windows operating systems utilizing the Windows Update Stack
Subscribe to Daily Vulnerability Briefings & KEV Alerts
Concise morning briefings for SecOps, DevSecOps, and SRE teams covering newly exploited CVEs and mitigation priorities.