7.8

CVE-2011-2005: Microsoft Ancillary Function Driver (afd.sys) Improper Input Validation Vulnerability

CVSS: 7.8v3.1HighKEVAnalyzed
Published 12-10-2011Last modified 22-10-2025
Open JSON

Vulnerability summary

CVE-2011-2005 is a high (CVSS 7.8) vulnerability in Microsoft Ancillary Function Driver (afd.sys). It is known to be exploited: CISA lists it, first on 28-03-2022. EPSS estimates a 31.76% chance of exploitation in the next 30 days, higher than 98.2% of scored vulnerabilities. 3 public exploits are recorded.

Overall risk
85/100
0100
Critical · default modelHow is this calculated?
CVSS score
7.8/10
010
High · v3.1 (CVE.org)
EPSS score
31.76%
0%100%
High · +0.23 pp in 30 days
KEVListedCISA
RansomwareNone recordedNo known use recorded
Public exploits3exploit-database, metasploit

Timeline

  1. 12-10-2011
    PublishedVulnerability first disclosed.
  2. 28-03-2022
    Added to CISA KEVMicrosoft Ancillary Function Driver (afd.sys) Improper Input Validation Vulnerability
  3. 18-04-2022
    CISA remediation dueApply updates per vendor instructions.
  4. 22-10-2025
    Last modifiedVulnerability information updated.

Description

afd.sys in the Ancillary Function Driver in Microsoft Windows XP SP2 and SP3 and Server 2003 SP2 does not properly validate user-mode input passed to kernel mode, which allows local users to gain privileges via a crafted application, aka "Ancillary Function Driver Elevation of Privilege Vulnerability."

CVSS metrics

3 scores · 2 sources · 2 versions

EPSS trend

Probability

31.76%

Chance of exploitation in the next 30 days

Percentile

98%

Versus all other CVEs

30-day change

+0.23 pp

From 31.53% on 19-09-2026

19-09-202619-10-2026
EPSS score
31.76%

Known exploited

Compare KEV catalogs
CISA KEVListed
Added
28-03-2022
Federal due date
18-04-2022

CISA required action

Apply updates per vendor instructions. nvd.nist.gov/vuln/detail/CVE-2011-2005

Public exploits

3 found
  • exploit-databaselocalwindowsVerified

    Microsoft Windows - 'AfdJoinLeaf' Local Privilege Escalation (MS11-080) (Metasploit)

    Maturity: weaponized

  • exploit-databaselocalwindowsVerified

    Microsoft Windows XP/2003 - 'afd.sys' Local Privilege Escalation (MS11-080)

    Maturity: weaponized

  • MetasploitMetasploitremoteUnverified

    MS11-080 AfdJoinLeaf Privilege Escalation

    exploit/windows/local/ms11_080_afdjoinleaf

    Maturity: poc

Weaknesses

CWE · root cause

No weakness data has been published for this record.

Affected systems

Microsoft2 products

1 vendor · 2 products

References

3 links