OMENWAVE modelled vulnerability-chaining pathways

CVE-2011-2005

afd.sys in the Ancillary Function Driver in Microsoft Windows XP SP2 and SP3 and Server 2003 SP2 does not properly validate user-mode input passed to kernel mode, which allows local users to gain privileges via a crafted application, aka "Ancillary Function Driver Elevation of Privilege Vulnerability."

7.8
CVSS High
31.8%
EPSS p98
YES
In CISA KEV

Data as of 2 Nov 2026 · NVD, CISA KEV, EPSS

Why chaining, at machine speed

Defenders still triage vulnerabilities one CVE at a time, while increasingly automated attackers combine them at machine speed. Omenwave models the plausible pathways by which this CVE could be chained with others — surfacing them for research and awareness, with evidence for each step.

Modelled capability profile
Kill-chain stage
EXECUTION
Requires
NONE access, LOCAL vector, user interaction
Grants
USER access
Capabilities
code execution
Model confidence
medium · CVSS 3.1
Top plausible next hops
CVE-2014-6324EXECUTION → EXECUTIONhigh plausibility · KEV

The access level the source grants already meets or exceeds the access level the destination requires — the position carries over.

The Kerberos Key Distribution Center (KDC) in Microsoft Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1…

CVE-2010-2568EXECUTION → EXECUTIONhigh plausibility · KEV

The source lands the attacker on the host (code execution or an established foothold), which satisfies the destination's requirement for local access.

Windows Shell in Microsoft Windows XP SP3, Server 2003 SP2, Vista SP1 and SP2, Server 2008 SP2 and R2, and Windows 7 allows local users or remote att…

CVE-2012-0151EXECUTION → EXECUTIONhigh plausibility · KEV

The source lands the attacker on the host (code execution or an established foothold), which satisfies the destination's requirement for local access.

The Authenticode Signature Verification function in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008…

CVE-2014-4113EXECUTION → EXECUTIONhigh plausibility · KEV

The source lands the attacker on the host (code execution or an established foothold), which satisfies the destination's requirement for local access.

win32k.sys in the kernel-mode drivers in Microsoft Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Win…

CVE-2014-4077EXECUTION → EXECUTIONhigh plausibility · KEV

The source lands the attacker on the host (code execution or an established foothold), which satisfies the destination's requirement for local access.

Microsoft Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, and Office 2007 SP3, when IMJPDCT.EXE (aka I…

Open in the interactive explorer →
Embed this snapshot

Paste this into a blog post or report — it renders a compact, exploit-free chain snapshot.

Modelled plausible chaining potential derived from public CVE metadata (CVSS, CWE, CPE). Not a confirmed real-world exploit chain and contains no exploitation detail. For research and awareness only.

Methodology · Interactive explorer · JSON: /cve/CVE-2011-2005