CVE-2025-21333
Microsoft Windows Hyper-V NT Kernel Integration VSP Heap-based Buffer Overflow Vulnerability
Description
CVE-2025-21333 is a high-severity elevation of privilege vulnerability in the Windows Hyper-V NT Kernel Integration Virtualization Service Provider (VSP). This kernel-mode flaw allows a locally authenticated attacker with low privileges to escalate to SYSTEM-level access on affected Windows 10, Windows 11, and Windows Server systems. Scored at CVSS v3.1 7.8 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), it carries the highest exploitation activity among a trio of related Hyper-V VSP vulnerabilities, with an EPSS score of 0.77984 (99.0th percentile). CISA has added it to the Known Exploited Vulnerabilities catalog with a remediation deadline of February 4, 2025.
KEV Information
CVSS Score
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| microsoft | windows 10 21h2 | < 10.0.19044.5371 |
| microsoft | windows 10 22h2 | < 10.0.19045.5371 |
| microsoft | windows 11 22h2 | < 10.0.22621.4751 |
| microsoft | windows 11 23h2 | < 10.0.22631.4751 |
| microsoft | windows 11 24h2 | < 10.0.26100.2894 |
| microsoft | windows server 2022 23h2 | < 10.0.25398.1369 |
| microsoft | windows server 2025 | < 10.0.26100.2894 |
References
- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-21333(Patch, Vendor Advisory)
- https://www.exploit-db.com/exploits/52436(Exploit, Third Party Advisory, VDB Entry)
- https://www.vicarius.io/vsociety/posts/cve-2025-21333-elevated-privilege-exposure-in-windows-hyper-v-by-microsoft-detection-script(Mitigation, Third Party Advisory)
- https://www.vicarius.io/vsociety/posts/cve-2025-21333-elevated-privilege-exposure-in-windows-hyper-v-by-microsoft-mitigation-script(Mitigation, Third Party Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-21333(US Government Resource)
Weakness Type
CWE — Unknown
Microsoft has not disclosed a specific CWE identifier for CVE-2025-21333. The vulnerability targets the Hyper-V NT Kernel Integration VSP, a kernel-mode driver that manages communication between the hypervisor host partition and guest virtual machines through synthetic device interfaces. The elevation of privilege classification and kernel-level attack surface suggest the weakness involves improper input validation, memory corruption, or unsafe handling of user-mode requests within the VSP driver. Microsoft's advisory system focuses on impact categorization rather than CWE-level root cause taxonomy, which is typical for their kernel vulnerability disclosures.
Impact Analysis
Kernel-Level System Takeover is the direct consequence of exploiting CVE-2025-21333. An attacker with any local user session on a Windows system running Hyper-V components gains complete SYSTEM-level control over the host, including access to all guest virtual machines.
Confidentiality Impact is maximum (C:H). SYSTEM access on a Hyper-V host enables the attacker to read virtual machine memory, disk files, and configuration data for all guest VMs. This includes credentials, encryption keys, database contents, and sensitive business information processed across the entire virtualized environment.
Integrity Impact is maximum (I:H). Full kernel-level privileges allow the attacker to modify any system or VM resource, install persistent backdoors in the hypervisor layer, tamper with guest operating systems, alter security configurations, disable antivirus and EDR agents, and manipulate audit logs to evade detection.
Availability Impact is maximum (A:H). The attacker can terminate all virtual machines, corrupt virtual disks, disable the Hyper-V service, wipe or encrypt the entire host system, or deploy ransomware that simultaneously affects all hosted workloads.
Elevated Threat Level: CVE-2025-21333 stands out among the trio of related Hyper-V VSP vulnerabilities (alongside CVE-2025-21334 and CVE-2025-21335) with a significantly higher EPSS score of 0.77984 (99.0th percentile), indicating that this specific vulnerability has attracted the most exploitation activity. The CISA KEV listing lists the ransomware association as "Unknown," but the extremely high EPSS score suggests widespread adoption by threat actors, potentially including ransomware operators targeting virtualized environments.
Exploit Maturity
CVE-2025-21333 is confirmed as actively exploited in the wild and represents the most heavily targeted of the three related Hyper-V VSP vulnerabilities disclosed in January 2025. CISA's Known Exploited Vulnerabilities catalog lists it with a mandatory remediation deadline of February 4, 2025. The EPSS score of 0.77984 places it in the 99.0th percentile, indicating it is among the most exploited vulnerabilities in the current threat landscape.
Public Exploit Code Available: A publicly available exploit has been published on Exploit-DB (EDB-52436), significantly lowering the barrier to exploitation. The availability of working exploit code means that attackers of varying skill levels can weaponize this vulnerability without developing their own exploits.
Detection and Mitigation Resources: Third-party security vendors have published detection and mitigation scripts. Vicarius has released both a detection script to identify vulnerable systems and a mitigation script for environments where immediate patching is not feasible.
Exploitation Context: The low attack complexity (AC:L) and low privilege requirements (PR:L) documented in the CVSS vector make this a highly reliable exploitation primitive. Threat actors use it in post-compromise scenarios where initial access has already been obtained through phishing, exposed services, or other attack vectors. The kernel-level escalation then provides the elevated access needed for lateral movement, data exfiltration, or ransomware deployment.
Ransomware Association: CISA classifies the ransomware association as "Unknown." However, the 99th percentile EPSS score and availability of public exploit code strongly suggest that ransomware operators have incorporated this vulnerability into their toolkits, particularly for attacks targeting Hyper-V infrastructure where host compromise enables simultaneous encryption of all guest VMs.
Remediation
-
Apply the January 2025 Cumulative Update immediately as the most critical remediation step. The Microsoft Security Response Center advisory provides the specific KB article for each affected platform. Patched versions include: Windows 10 21H2 (10.0.19044.5371), Windows 10 22H2 (10.0.19045.5371), Windows 11 22H2 (10.0.22621.4751), Windows 11 23H2 (10.0.22631.4751), Windows 11 24H2 (10.0.26100.2894), Windows Server 2022 23H2 (10.0.25398.1369), and Windows Server 2025 (10.0.26100.2894).
-
Treat this as an emergency patch for Hyper-V infrastructure due to the 99th percentile EPSS score and publicly available exploit code. Prioritize all Hyper-V hosts, domain controllers, and systems running Virtualization-Based Security features. Deploy through WSUS, SCCM, Intune, or direct Windows Update as an out-of-cycle emergency update.
-
Run the Vicarius detection script on systems where patch status is uncertain. The detection script can identify vulnerable systems across your environment, helping prioritize remediation efforts.
-
Restrict local access and harden Hyper-V hosts as interim mitigation. Remove unnecessary local user accounts, disable interactive logon for non-administrative users, enforce multi-factor authentication for all remote management access, and ensure that Hyper-V management is performed only through secured administrative workstations.
-
Monitor for exploitation activity using endpoint detection tools. Given the public exploit code, watch for suspicious interactions with the Hyper-V VSP kernel driver, unusual privilege escalation events, unexpected SYSTEM-level process creation, and anomalous behavior from Hyper-V processes (vmwp.exe, vmms.exe). Ensure your EDR signatures are updated to detect known exploit patterns for this vulnerability.
Technical Details
CVE-2025-21333 is an elevation of privilege vulnerability in the Windows Hyper-V NT Kernel Integration Virtualization Service Provider (VSP), a kernel-mode component responsible for managing synthetic device communication between the Hyper-V hypervisor host and guest virtual machines.
CVSS Vector Breakdown: The vector CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H results in a base score of 7.8. The local attack vector (AV:L) requires execution on the target system. Low attack complexity (AC:L) means no special timing, configuration, or race conditions are needed. Low privileges (PR:L) indicate any standard user account provides sufficient access. No user interaction (UI:N) is required. The unchanged scope (S:U) confines the impact to the vulnerable system's authority. All impact metrics are maximum (C:H/I:H/A:H), reflecting complete system compromise.
Attack Mechanism: The Hyper-V NT Kernel Integration VSP runs within the Windows kernel to process requests from user-mode applications interacting with the virtualization stack. The vulnerability allows a low-privileged user-mode process to send specifically crafted requests to the VSP kernel driver that trigger an exploitable condition — likely involving memory corruption, improper bounds checking, or unsafe pointer handling. Successful exploitation results in arbitrary code execution within the kernel context, granting SYSTEM-level privileges. The publicly available Exploit-DB entry (EDB-52436) demonstrates a working exploitation technique for this vulnerability.
Affected Systems and Scope: All Windows systems with active Hyper-V components are vulnerable. This includes: dedicated Hyper-V Server hosts, Windows workstations and servers with the Hyper-V role enabled, systems using Virtualization-Based Security (VBS) features including Credential Guard, Device Guard, Hypervisor-Enforced Code Integrity (HVCI), Windows Sandbox, and WSL 2. The affected version range spans Windows 10 21H2 through Windows Server 2025.
Relationship to CVE-2025-21334 and CVE-2025-21335: These three vulnerabilities form a cluster targeting the same Hyper-V VSP kernel driver, all disclosed in the same January 2025 Patch Tuesday. While they share identical CVSS scores and impact profiles, CVE-2025-21333 has significantly higher exploitation activity (EPSS 0.77984 vs. 0.07561 and 0.09894 for the other two), suggesting it may be the most reliable or easily exploitable of the three, or that it was the first to be weaponized by threat actors.
Frequently Asked Questions
What is CVE-2025-21333?
CVE-2025-21333 is a high-severity elevation of privilege vulnerability in the Windows Hyper-V NT Kernel Integration VSP kernel driver. It allows a local attacker with standard user privileges to escalate to SYSTEM access on Windows 10, Windows 11, and Windows Server systems. It is the most actively exploited of three related Hyper-V VSP vulnerabilities patched in January 2025.
Is there a public exploit available for CVE-2025-21333?
Yes. A working exploit has been published on Exploit-DB (EDB-52436), making this vulnerability accessible to a broad range of attackers. This significantly increases the urgency of patching, as exploitation no longer requires advanced technical skills or custom exploit development.
Why does CVE-2025-21333 have a higher EPSS score than its sibling CVEs?
CVE-2025-21333 has an EPSS score of 0.77984 (99th percentile), compared to 0.07561 and 0.09894 for CVE-2025-21334 and CVE-2025-21335 respectively. This likely reflects the public availability of exploit code on Exploit-DB, which dramatically increases exploitation activity. The other two vulnerabilities, while also actively exploited, do not have publicly available exploit code.
Does this vulnerability affect Windows systems not running virtual machines?
Yes. The Hyper-V kernel components can be active on systems that use Hyper-V-dependent features without running traditional VMs. This includes Credential Guard, Device Guard, Windows Sandbox, WSL 2, and other Virtualization-Based Security features. If the Hyper-V feature is enabled at the Windows level, the vulnerable VSP driver may be loaded regardless of VM activity.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.