CVE-2011-2005 Microsoft Ancillary Function Driver (afd.sys) Improper Input Validation

Exploited in the wild High 7.8 Published 12 Oct 2011 Updated 22 Oct 2025

Local attackers can gain elevated privileges by exploiting improper input validation in the Windows Ancillary Function Driver.

Exploited in the wild: Since 28 Mar 2022
Login needed: Not needed
Attackable: Local or same network only
Victim action needed: A user has to click or open something
Fix: None listed

What is CVE-2011-2005?

CVE-2011-2005 is a high-severity vulnerability in Microsoft Windows Server 2003, published on 12 Oct 2011. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.

Official description

afd.sys in the Ancillary Function Driver in Microsoft Windows XP SP2 and SP3 and Server 2003 SP2 does not properly validate user-mode input passed to kernel mode, which allows local users to gain privileges via a crafted application, aka "Ancillary Function Driver Elevation of Privilege Vulnerability."

Which versions are affected by CVE-2011-2005?

It affects 2 products.

Products include Microsoft Windows Server 2003, Microsoft Windows Xp.

How do I fix CVE-2011-2005?

No fix has been published for CVE-2011-2005 yet. Limit exposure of the affected software until one is available. US federal agencies must fix it by 18 Apr 2022.

Is CVE-2011-2005 being exploited?

Yes. Attackers have exploited CVE-2011-2005 in the wild since at least 28 Mar 2022.

Public exploit code: 1 Metasploit module and 2 Exploit-DB entries.

All Microsoft Windows Server 2003 vulnerabilities

Sources

Also known as GHSA-8q8w-v8pg-496j.