Live › vulnerability › CVE-2011-2005
Go to dashboardMicrosoft Windows afd.sys, the kernel driver behind Winsock socket calls, does not validate user-mode input passed to kernel mode. A local user running a crafted application can escalate to kernel-level privileges.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 19:11 UTC, 3h before NVD. All times on this page are UTC.
Apply updates per vendor instructions.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| Microsoft Ancillary Function Driver (afd.sys) | vendor | – | – |
Unknown from the sources.
Apply the Microsoft updates for this CVE per vendor instructions, as CISA requires; the sources do not name the specific patch or KB.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
afd.sys in the Ancillary Function Driver in Microsoft Windows XP SP2 and SP3 and Server 2003 SP2 does not properly validate user-mode input passed to kernel mode, which allows local users to gain privileges via a crafted application, aka "Ancillary Function Driver Elevation of Privilege Vulnerability."
This page as .md · .json · in your agent: get_signal("CVE-2011-2005")
CISA KEV catalog, Creative Commons 0 · EPSS scores by FIRST, used with attribution · NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.