CVE-2011-2005VulnerabilityPublished 03/28/2022Updated 10/24/2026

CVE-2011-2005: Microsoft Ancillary Function Driver (afd.sys) Improper Input Validation Vulnerability

Affects Microsoft Ancillary Function Driver (afd.sys)Source CISA KEV

Severity

High

No CVSS score published yet

Exploitation: Actively exploited – in CISA KEV since 03/28/2022
KEV deadline: 04/18/2022
EPSS: 31.8% chance of exploitation in 30 days – higher than 98% of CVEs

What to do

CISA required action

Apply updates per vendor instructions.

nvd.nist.gov/vuln/detail/CVE-2011-2005 (opens in a new tab)

Description

CVE-2011-2005 is a vulnerability in the Microsoft Ancillary Function Driver (afd.sys) where improper validation of user-mode input passed to kernel mode allows local users to gain elevated privileges. This vulnerability has been exploited in the wild. No specific affected versions or patch information is provided in the available data.

Summary

The vulnerability in afd.sys arises from improper input validation of user-mode data passed to kernel mode in the Ancillary Function Driver component of Microsoft Windows. This flaw enables local attackers to escalate privileges by crafting specific applications that exploit this validation weakness. The vulnerability is identified as CVE-2011-2005 and is associated with CWE-264 (Permissions, Privileges, and Access Controls). It has been exploited in the wild, indicating active threat usage. However, no explicit patch or remediation details are provided in the input data.

Impact

Local users can exploit this vulnerability to gain elevated privileges on affected Microsoft Windows systems, potentially allowing them to execute code with higher privileges than intended. This can lead to unauthorized system modifications or control. The vulnerability has been observed in active exploitation scenarios.

Mitigation

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until official fixes or mitigations are confirmed, restrict local user access and monitor for suspicious activity related to afd.sys exploitation attempts.

Weaknesses

CWE-264Unclassified weakness (opens in a new tab)

What to do

Description

AnalysisAI-generated, updated 10/24/2026, 11:11:15 UTC

Weaknesses

References

Related threats