CVE-2011-1249

Description

The Ancillary Function Driver (AFD) in afd.sys in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP1 and SP2, Windows Server 2008 Gold, SP2, R2, and R2 SP1, and Windows 7 Gold and SP1 does not properly validate user-mode input, which allows local users to gain privileges via a crafted application, aka "Ancillary Function Driver Elevation of Privilege Vulnerability."

Public exploits

Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.

Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.

Exploit-DB 2

Microsoft Windows (x86) - 'afd.sys' Local Privilege Escalation (MS11-046) EDB-40564 · local · Oct 18, 2016 · verified
Microsoft Windows - 'afd.sys' Local Kernel (PoC) (MS11-046) EDB-18755 · dos · Apr 19, 2012

GitHub 3 repositories

h3x0v3rl0rd/CVE-2011-1249 ★ 1 · Jul 10, 2021
appl3b0y/edb-40564-mingw-fix ★ 0 · May 6, 2026

CVE-2011-1249 (MS11-046) AFD privilege escalation — MinGW cross-compilation fix + custom command support
Madusanka99/OHTS ★ 0 · May 13, 2020

Microsoft Windows - 'afd.sys' Local Kernel Privilege Escalation Exploit Report (CVE-2011-1249)

Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.

References

MS11-046 vendor-advisory
40564 exploit
oval:org.mitre.oval:def:12731 vdb-entry signature