CVE-2011-2005
Last modified
CVE-2011-2005 is a high-severity vulnerability rated 7.8/10 on the CVSS scale. afd.sys in the Ancillary Function Driver in Microsoft Windows XP SP2 and SP3 and Server 2003 SP2 does not properly validate user-mode input passed to kernel mode, which allows local users to gain privileges via a crafted application, aka "Ancillary Function Driver Elevation of Privilege Vulnerability.". CISA has confirmed active exploitation in the wild. EPSS estimates a 31.76% chance of exploitation in the next 30 days.
Description
afd.sys in the Ancillary Function Driver in Microsoft Windows XP SP2 and SP3 and Server 2003 SP2 does not properly validate user-mode input passed to kernel mode, which allows local users to gain privileges via a crafted application, aka "Ancillary Function Driver Elevation of Privilege Vulnerability."
Metrics
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Exploitation Status
This vulnerability is listed in CISA’s Known Exploited Vulnerabilities catalog, confirming active exploitation in the wild. Federal agencies must remediate by .
Affected Software
| Vendor | Product | Versions | Update |
|---|---|---|---|
| Microsoft | Windows Server 2003 | All versions | Sp2 |
| Microsoft | Windows Xp | All versions | Sp2 |
References
- https://docs.microsoft.com/en-us/security-updates/securitybulletins/2011/ms11-080Patch, Vendor Advisory
- https://docs.microsoft.com/en-us/security-updates/securitybulletins/2011/ms11-080Patch, Vendor Advisory
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2011-2005US Government Resource
Timeline
- Published
- Last Modified
- Status
- Analyzed
Frequently Asked Questions
What is CVE-2011-2005?
How severe is CVE-2011-2005?
How do I fix CVE-2011-2005?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2011
- CVE-2011-20001A vulnerability has been identified in SIMATIC S7-1200 CPU V…8.7
- CVE-2011-20002A vulnerability has been identified in SIMATIC S7-1200 CPU V…8.3
- CVE-2011-2001Microsoft Internet Explorer 6 through 9 does not properly ha…
- CVE-2011-2002win32k.sys in the kernel-mode drivers in Microsoft Windows V…
- CVE-2011-2003Buffer overflow in win32k.sys in the kernel-mode drivers in …
- CVE-2011-2004Array index error in win32k.sys in the kernel-mode drivers i…
- CVE-2011-2006Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
- CVE-2011-2007Microsoft Host Integration Server (HIS) 2004 SP1, 2006 SP1, …
- CVE-2011-2008Microsoft Host Integration Server (HIS) 2004 SP1, 2006 SP1, …
- CVE-2011-2009Untrusted search path vulnerability in Windows Media Center …
- CVE-2011-2010The Microsoft Office Input Method Editor (IME) for Simplifie…
- CVE-2011-2011Use-after-free vulnerability in win32k.sys in the kernel-mod…
Are you affected by CVE-2011-2005?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST