Skip to content
skopnix
Dossier · Vulnerability

Actively exploited · CISA KEV · NVD published 2011-10-12

CVE-2011-2005

afd.sys in the Ancillary Function Driver in Microsoft Windows XP SP2 and SP3 and Server 2003 SP2 does not properly validate user-mode input passed to kernel mode, which allows local users to gain privileges via a crafted application, aka "Ancillary Function Driver Elevation of Privilege Vulnerability."

  1. First PoC
  2. 4195 days →Metasploit
  3. 1241 days →First cited attacker

Signals

Exploited in the wild
Yesadded 2022-03-28 · due 2022-04-18. An observation, not a forecast.
EPSS · 30-day forecast
32%Chance of exploitation in the next 30 days, 98th percentile of all CVEs. A forecast; KEV outranks it.
CVSS · NVD · HIGH
7.8CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Internet exposure
not stated by sourcesNo exposure census on this CVE's dispatches.

Exploits

3 known · links only

Metasploit1

  1. MS11-080 AfdJoinLeaf Privilege Escalation ↗

    This module exploits a flaw in the AfdJoinLeaf function of the afd.sys driver to overwrite data in kernel space. An address within the HalDispatchTable is overwritten and when triggered with a call to NtQueryIntervalProfile will execute shellcode. This module will elevate itself to SYSTEM, then inject the payload into another SYSTEM process before restoring its own token to avoid causing system instability.

    ruby · seen 2026-10-18

Exploit-DB2

  1. Microsoft Windows XP/2003 - 'afd.sys' Local Privilege Escalation (MS11-080) ↗

    created 2011-11-30

  2. Microsoft Windows - 'AfdJoinLeaf' Local Privilege Escalation (MS11-080) (Metasploit) ↗

    created 2012-10-10

On the wire

0 dispatches

No dispatch on our wire has named this CVE yet.

Watch this one?

KEV additions reach Telegram and the KEV-only RSS as they land.

Follow on TelegramKEV RSSAPI

Check your stack

Paste what you run: the CVEs exploited in the wild against it, and who is cited as exploiting them, with the report.

Stack checkNo key. No signup.