CVE-2025-21334
Microsoft Windows Hyper-V NT Kernel Integration VSP Use-After-Free Vulnerability
Description
CVE-2025-21334 is a high-severity elevation of privilege vulnerability in the Windows Hyper-V NT Kernel Integration Virtualization Service Provider (VSP). This flaw enables a locally authenticated attacker with low privileges to escalate to SYSTEM-level access by exploiting the kernel-mode Hyper-V integration component. Rated CVSS v3.1 7.8 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), it affects Windows 10, Windows 11, and Windows Server editions. The vulnerability is listed in CISA's Known Exploited Vulnerabilities catalog with a remediation deadline of February 4, 2025, and its EPSS score of 0.07561 (91.7th percentile) signals high exploitation likelihood.
KEV Information
CVSS Score
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| microsoft | windows 10 21h2 | < 10.0.19044.5371 |
| microsoft | windows 10 22h2 | < 10.0.19045.5371 |
| microsoft | windows 11 22h2 | < 10.0.22621.4751 |
| microsoft | windows 11 23h2 | < 10.0.22631.4751 |
| microsoft | windows 11 24h2 | < 10.0.26100.2894 |
| microsoft | windows server 2022 23h2 | < 10.0.25398.1369 |
| microsoft | windows server 2025 | < 10.0.26100.2894 |
References
- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-21334(Patch, Vendor Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-21334(US Government Resource)
Weakness Type
CWE — Unknown
Microsoft has not assigned a specific CWE identifier to CVE-2025-21334. The vulnerability exists within the Hyper-V NT Kernel Integration VSP, a kernel-mode driver responsible for mediating communication between the hypervisor host partition and guest virtual machines. Given the elevation of privilege classification and the kernel-level attack surface, the underlying weakness likely involves improper validation of inputs or memory operations in the VSP driver, enabling a user-mode process running under low privileges to trigger code execution in the kernel context. Microsoft typically classifies such vulnerabilities by impact category rather than publishing detailed root cause classifications.
Impact Analysis
Complete Host Compromise via Privilege Escalation is the central risk of CVE-2025-21334. An attacker with low-privilege local access to a Windows system running Hyper-V components can escalate to SYSTEM privileges, achieving full control over the host and all virtual machines it manages.
Confidentiality Impact is rated high (C:H). SYSTEM-level access on a Hyper-V host permits the attacker to read all data on the system, including virtual machine disk files, memory contents of running VMs, cryptographic keys, stored credentials, and security configurations. In enterprise environments, this could expose sensitive business data across multiple virtualized workloads.
Integrity Impact is rated high (I:H). With full kernel-level control, an attacker can modify system files, install rootkits, alter virtual machine configurations, inject malicious code into guest operating systems, disable security controls, and manipulate audit logs to cover their tracks.
Availability Impact is rated high (A:H). An attacker can terminate virtual machines, corrupt virtual hard disks, disable the Hyper-V service, deploy destructive malware, or render the entire host inoperable. For organizations relying on Hyper-V for critical infrastructure, this can result in severe business disruption.
Exploitation Probability: The EPSS score of 0.07561 (91.7th percentile) combined with active exploitation confirmed by CISA's KEV listing demonstrates that threat actors are actively targeting this vulnerability. The ransomware association is classified as "Unknown" by CISA, but privilege escalation vulnerabilities in virtualization infrastructure are prime targets for ransomware operators seeking to encrypt entire virtual environments.
Exploit Maturity
CVE-2025-21334 is confirmed as actively exploited in the wild, as documented by its inclusion in CISA's Known Exploited Vulnerabilities catalog with a mandatory remediation deadline of February 4, 2025. The EPSS score of 0.07561 places it in the 91.7th percentile, indicating substantially higher exploitation activity than the vast majority of published vulnerabilities.
Active Exploitation Context: CISA's KEV listing confirms real-world exploitation. As a local privilege escalation vulnerability, CVE-2025-21334 is typically used as a post-initial-access tool in attack chains. Threat actors first compromise a system through remote means such as phishing, exposed services, or other vulnerabilities, then leverage this flaw to escalate from a standard user to SYSTEM on the Hyper-V host.
Exploitation Characteristics: The CVSS vector reflects low attack complexity (AC:L) and no user interaction requirement (UI:N), meaning exploitation is reliable once the attacker has local access. The low privilege requirement (PR:L) means any authenticated user account is sufficient to trigger the vulnerability. These factors make it an attractive and dependable escalation primitive for attackers.
Cluster of Related Vulnerabilities: CVE-2025-21334 was disclosed alongside CVE-2025-21333 and CVE-2025-21335, all affecting the same Hyper-V VSP component. The existence of three related vulnerabilities in the same module suggests a broad weakness in the VSP code that may have been identified through coordinated incident response or targeted auditing after initial exploitation was detected.
Ransomware Association: CISA classifies the ransomware association as "Unknown." Nevertheless, Hyper-V host compromise is an extremely high-value objective for ransomware groups because it enables simultaneous encryption or destruction of all guest VMs from the host level.
Remediation
-
Apply the January 2025 Cumulative Update from Microsoft as the highest priority. Refer to the Microsoft Security Response Center advisory for the correct KB article for your platform. Patched build numbers are: Windows 10 21H2 (10.0.19044.5371), Windows 10 22H2 (10.0.19045.5371), Windows 11 22H2 (10.0.22621.4751), Windows 11 23H2 (10.0.22631.4751), Windows 11 24H2 (10.0.26100.2894), Windows Server 2022 23H2 (10.0.25398.1369), and Windows Server 2025 (10.0.26100.2894).
-
Patch Hyper-V hosts and critical servers first in your deployment schedule. Hyper-V hosts managing production VMs represent the greatest risk because compromising one host can cascade to all its guest machines. Use WSUS, SCCM, Intune, or another patch management system to fast-track deployment.
-
Limit local access to Hyper-V hosts as an immediate risk reduction measure. Remove unnecessary local user accounts, disable interactive logon for non-administrative users, and enforce multi-factor authentication for all remote access to Hyper-V hosts. Apply the principle of least privilege rigorously.
-
Deploy endpoint detection and response monitoring focused on the Hyper-V stack. Configure alerts for suspicious activity originating from or targeting Hyper-V processes (vmwp.exe, vmms.exe) and the VSP kernel driver. Monitor for unusual privilege escalation events, unexpected kernel driver loading, and anomalous process creation from Hyper-V components.
-
Reboot systems after patching to ensure the kernel-level fix takes effect. Verify successful update installation through Windows Update history, WSUS compliance reports, or your endpoint management platform. Systems that have not been rebooted after the update remain vulnerable.
Technical Details
CVE-2025-21334 is an elevation of privilege vulnerability in the Windows Hyper-V NT Kernel Integration Virtualization Service Provider (VSP), a kernel-mode component that manages synthetic device communication between the Hyper-V host partition and guest virtual machines.
CVSS Vector Breakdown: The vector CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H produces a base score of 7.8. The attack vector is local (AV:L), requiring the attacker to execute code on the target system. Attack complexity is low (AC:L), indicating no special conditions or race windows are needed. Only low-level privileges are required (PR:L), meaning a standard user account provides sufficient access. No user interaction (UI:N) is needed. The scope remains unchanged (S:U), and all three impact categories are rated high (C:H/I:H/A:H), reflecting full system compromise.
Attack Mechanism: The Hyper-V NT Kernel Integration VSP operates within the Windows kernel to service requests from user-mode processes interacting with the virtualization stack. The vulnerability allows a user-mode process running with low privileges to send crafted requests or perform specific operations against the VSP driver that result in improper handling within the kernel. This improper handling enables the attacker's code to execute with kernel (SYSTEM) privileges, bypassing all user-mode security boundaries.
Scope of Affected Systems: The vulnerability affects any Windows system where Hyper-V components are active. This includes dedicated Hyper-V Server hosts, Windows workstations with Hyper-V enabled, and systems using Hyper-V-dependent security features such as Credential Guard, Virtualization-Based Security (VBS), Windows Sandbox, and WSL 2. The affected versions span Windows 10 21H2 and 22H2, Windows 11 22H2 through 24H2, Windows Server 2022 23H2, and Windows Server 2025.
Relationship to Sibling CVEs: CVE-2025-21334 is one of three related vulnerabilities (alongside CVE-2025-21333 and CVE-2025-21335) disclosed simultaneously in the same Hyper-V VSP component. All three carry identical CVSS scores and impact profiles, suggesting they represent distinct exploitable flaws within the same kernel driver module. The January 2025 Cumulative Update addresses all three vulnerabilities.
Frequently Asked Questions
What is CVE-2025-21334?
CVE-2025-21334 is a high-severity elevation of privilege vulnerability in the Windows Hyper-V NT Kernel Integration VSP component. It enables a locally authenticated attacker with low-level privileges to escalate to SYSTEM access on affected Windows 10, Windows 11, and Windows Server systems. Microsoft addressed it in the January 2025 Patch Tuesday release.
How does CVE-2025-21334 differ from CVE-2025-21333 and CVE-2025-21335?
All three vulnerabilities affect the same Hyper-V NT Kernel Integration VSP kernel driver and share identical CVSS scores of 7.8. They represent distinct security flaws within the same component, discovered and patched concurrently. While CVE-2025-21333 has notably higher exploitation activity (EPSS 0.77984, 99th percentile), CVE-2025-21334 and CVE-2025-21335 are also confirmed as actively exploited.
Do I need Hyper-V VMs running to be vulnerable?
Not necessarily. The Hyper-V NT Kernel Integration VSP can be active on systems where the Hyper-V feature is enabled, even without running virtual machines. Additionally, Windows features like Credential Guard, Device Guard, Windows Sandbox, and WSL 2 rely on Hyper-V components and may activate the vulnerable driver.
What is the urgency for patching CVE-2025-21334?
The urgency is high. CISA has set a mandatory remediation deadline of February 4, 2025, and the vulnerability is confirmed as actively exploited. Organizations should treat this as an emergency patch, prioritizing Hyper-V hosts and systems running virtualization-dependent security features.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.