CVE-2011-2005

Local privilege escalation via improper input validation in Microsoft's Ancillary Function Driver (afd.sys).

A local user can escalate privileges by passing unvalidated user-mode input to kernel mode in afd.sys. DIB orgs must patch this unpatched, actively exploited vulnerability to prevent privilege escalation and potential lateral movement. The flaw is not an RCE but a local privilege escalation, and it was not a zero-day as it was actively exploited in the KEV catalog.

Shame score — Microsoft shipped a known, actively exploited vulnerability for years without a patch, enabling local privilege escalation that attackers leveraged for lateral movement.