Actively exploited · Published Oct 12, 2011 · Assigned by microsoft

CVE-2011-2005

High 7.8 Exploited

In plain English

A high-severity security flaw in Ancillary Function Driver (afd.sys) from Microsoft. Attackers are actively exploiting it in the wild (listed by CISA on March 28, 2022). The chance it is exploited in the next 30 days is estimated at 31.8% (higher than 98% of all known vulnerabilities). Ready-made attack tooling exists: Metasploit. Apply updates per vendor instructions.

Severity (CVSS 3.1)7.8High

Exploit odds (30 days)31.8%top 1.7% of all CVEs

Exploited in the wildYesCISA KEV since Mar 28, 2022

Attack tooling1Metasploit

CISA guidance

Apply updates per vendor instructions.

Federal agencies must remediate by Apr 18, 2022.

Official description

afd.sys in the Ancillary Function Driver in Microsoft Windows XP SP2 and SP3 and Server 2003 SP2 does not properly validate user-mode input passed to kernel mode, which allows local users to gain privileges via a crafted application, aka "Ancillary Function Driver Elevation of Privilege Vulnerability."

Affected products (as reported)

Vendor	Product	Versions
n/a	n/a	n/a

References

oval:org.mitre.oval:def:13114 vdb-entry, signature, x_refsource_OVAL
MS11-080 vendor-advisory, x_refsource_MS
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2011-2005 government-resource