Windows afd.sys CVE-2011-2005

Apply Microsoft Security Bulletin MS11-080 immediately via Windows Update or manual download from https://docs.microsoft.com/en-us/security-updates/securitybulletins/2011/ms11-080. The bulletin provides specific KB article numbers and replacement supersedence information for each affected platform. However, given that Windows XP and Server 2003 reached extended support end-of-life in 2014 and 2015 respectively, the STRONGLY RECOMMENDED remediation is migrating affected systems to supported operating systems (Windows 10/11 or Server 2016/2019/2022). If migration is impossible due to operational constraints, implement defense-in-depth compensating controls: restrict local logon rights to only essential administrative users through Group Policy (Computer Configuration > Windows Settings > Security Settings > Local Policies > User Rights Assignment), deploy application whitelisting via Software Restriction Policies or AppLocker to prevent execution of unauthorized binaries (mitigates social engineering delivery), enable audit logging for privilege escalation attempts (Security log Event ID 4672 for special privileges assigned to new logon), and network-isolate legacy systems from internet access and untrusted network segments. Note that compensating controls only reduce attack surface and do not eliminate the vulnerability - attackers with physical access or who compromise authorized user accounts can still exploit this flaw.