CVE-2025-21335
Microsoft Windows Hyper-V NT Kernel Integration VSP Use-After-Free Vulnerability
Description
CVE-2025-21335 is a high-severity elevation of privilege vulnerability in the Windows Hyper-V NT Kernel Integration Virtualization Service Provider (VSP). Affecting multiple versions of Windows 10, Windows 11, and Windows Server, this flaw allows a locally authenticated attacker with low privileges to escalate to SYSTEM-level access by exploiting the Hyper-V kernel integration component. With a CVSS v3.1 base score of 7.8 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), the vulnerability is listed in CISA's Known Exploited Vulnerabilities catalog with a remediation deadline of February 4, 2025. The EPSS score of 0.09894 (92.9th percentile) indicates significant exploitation probability in the wild.
KEV Information
CVSS Score
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| microsoft | windows 10 21h2 | < 10.0.19044.5371 |
| microsoft | windows 10 22h2 | < 10.0.19045.5371 |
| microsoft | windows 11 22h2 | < 10.0.22621.4751 |
| microsoft | windows 11 23h2 | < 10.0.22631.4751 |
| microsoft | windows 11 24h2 | < 10.0.26100.2894 |
| microsoft | windows server 2022 23h2 | < 10.0.25398.1369 |
| microsoft | windows server 2025 | < 10.0.26100.2894 |
References
- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-21335(Patch, Vendor Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-21335(US Government Resource)
Weakness Type
CWE — Unknown
Microsoft has not disclosed a specific CWE classification for CVE-2025-21335. The vulnerability resides in the Hyper-V NT Kernel Integration VSP, a privileged kernel component that handles communication between the Hyper-V hypervisor and guest virtual machines. Based on the elevation of privilege nature and the kernel-level component involved, the flaw likely stems from improper validation of requests or memory operations within the VSP driver, allowing a low-privileged local user to execute code with elevated kernel privileges. The absence of a formal CWE designation is common for Microsoft advisories, which often categorize vulnerabilities by impact rather than root cause classification.
Impact Analysis
Full System Compromise from Low-Privilege Access is the primary risk posed by CVE-2025-21335. An attacker who has already obtained a basic user session on a Windows system running Hyper-V can leverage this vulnerability to escalate to SYSTEM privileges, gaining unrestricted control over the host operating system and all virtual machines managed by the hypervisor.
Confidentiality Impact is rated high (C:H). Successful exploitation grants the attacker kernel-level read access, enabling them to extract sensitive data from the host system and potentially from guest virtual machines. This includes cryptographic keys, credentials stored in memory, security tokens, and any data processed by the Hyper-V hypervisor layer.
Integrity Impact is rated high (I:H). With SYSTEM-level privileges on a Hyper-V host, an attacker can modify system binaries, install persistent backdoors, tamper with virtual machine configurations, inject code into running VMs, and alter security policies. The integrity of the entire virtualization infrastructure becomes compromised.
Availability Impact is rated high (A:H). SYSTEM access allows the attacker to shut down or corrupt virtual machines, disable Hyper-V services, render the host inoperable, or deploy destructive payloads such as ransomware. In enterprise environments where Hyper-V hosts run critical workloads, this could cause significant business disruption.
Exploitation Context: The EPSS score of 0.09894 (92.9th percentile) and confirmed active exploitation via the CISA KEV listing underscore the real-world threat. CISA lists the ransomware association as "Unknown," though kernel-level privilege escalation vulnerabilities are frequently chained with remote access exploits to deploy ransomware across virtualized infrastructure.
Exploit Maturity
CVE-2025-21335 is confirmed as actively exploited in the wild, as evidenced by its inclusion in CISA's Known Exploited Vulnerabilities catalog with a mandatory remediation deadline of February 4, 2025. The EPSS score of 0.09894 places it in the 92.9th percentile, indicating substantially elevated exploitation probability compared to the general vulnerability population.
Active Exploitation Confirmed: CISA's KEV listing confirms that threat actors are leveraging this vulnerability in real-world attacks. As a local privilege escalation flaw in a kernel-level Hyper-V component, it is commonly used as part of a multi-stage attack chain where an attacker first gains initial access through phishing, a web application vulnerability, or other remote vector, then uses CVE-2025-21335 to escalate privileges to SYSTEM on the Hyper-V host.
Exploitation Complexity: The CVSS vector indicates low attack complexity (AC:L) and no user interaction required (UI:N), meaning once an attacker has local low-privilege access, exploitation is reliable and straightforward. The local attack vector (AV:L) limits the vulnerability to attackers with existing system access, but this is a standard prerequisite for privilege escalation exploits.
Ransomware Association: CISA classifies the ransomware association as "Unknown." However, Hyper-V privilege escalation vulnerabilities are highly attractive to ransomware operators because compromising the hypervisor host provides access to encrypt or destroy all guest virtual machines simultaneously, maximizing the impact of the attack.
Remediation
-
Apply the January 2025 Cumulative Update from Microsoft immediately. Visit the Microsoft Security Response Center advisory to identify the specific KB article for your Windows version. The patched versions are: Windows 10 21H2 build 10.0.19044.5371, Windows 10 22H2 build 10.0.19045.5371, Windows 11 22H2 build 10.0.22621.4751, Windows 11 23H2 build 10.0.22631.4751, Windows 11 24H2 build 10.0.26100.2894, Windows Server 2022 23H2 build 10.0.25398.1369, and Windows Server 2025 build 10.0.26100.2894.
-
Prioritize Hyper-V hosts and domain controllers in the patching sequence. These systems represent the highest-value targets because compromising a Hyper-V host provides access to all guest VMs. Use WSUS, SCCM, Intune, or your preferred patch management tool to deploy the update as an emergency out-of-cycle patch.
-
Restrict local access to Hyper-V hosts as an interim mitigation if patching cannot be performed immediately. Ensure that only authorized administrators have interactive logon rights to Hyper-V host systems. Remove unnecessary user accounts, disable Remote Desktop access for non-administrative users, and enforce the principle of least privilege.
-
Monitor for exploitation indicators using endpoint detection and response (EDR) solutions. Watch for suspicious process creation from the vmwp.exe (Virtual Machine Worker Process) or other Hyper-V components, unusual privilege escalation patterns, and attempts to access or modify the VSP kernel driver.
-
Verify patch deployment and system reboot to confirm remediation. The kernel-level nature of this fix requires a system restart. Use Windows Update history or your patch management console to verify the update was successfully applied and the system was rebooted after installation.
Technical Details
CVE-2025-21335 is an elevation of privilege vulnerability in the Windows Hyper-V NT Kernel Integration Virtualization Service Provider (VSP), a kernel-mode component that facilitates communication between the Hyper-V hypervisor and guest virtual machines running on Windows hosts.
CVSS Vector Breakdown: The vector CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H yields a base score of 7.8. The local attack vector (AV:L) requires the attacker to have existing access to the target system. Low attack complexity (AC:L) indicates reliable exploitation without special conditions. Low privileges required (PR:L) means any standard user account suffices. No user interaction (UI:N) is needed beyond the attacker's own actions. The scope is unchanged (S:U), meaning the privilege escalation affects only the vulnerable system's security context. All three impact metrics are high (C:H/I:H/A:H), reflecting complete system compromise upon successful exploitation.
Attack Mechanism: The Hyper-V NT Kernel Integration VSP operates at the kernel level to manage synthetic device requests between the host partition and guest virtual machines. The vulnerability exists in how the VSP handles certain requests or memory operations from user-mode callers. A locally authenticated attacker with low privileges can craft specific requests to the VSP driver that trigger improper handling, resulting in code execution in the kernel context. Because kernel code runs with SYSTEM privileges, the attacker effectively escalates from a standard user to full system administrator.
Affected Components: The VSP is a core component of the Hyper-V virtualization stack. It is present and active on any Windows system that has the Hyper-V role or feature enabled, including both full Hyper-V hosts and systems using Hyper-V-based security features such as Credential Guard, Device Guard, or Windows Sandbox. This broadens the attack surface beyond dedicated virtualization servers to include workstations with these security features enabled.
Related Vulnerabilities: CVE-2025-21335 was disclosed alongside CVE-2025-21333 and CVE-2025-21334, all three affecting the same Hyper-V NT Kernel Integration VSP component with identical CVSS scores and impact profiles. This suggests multiple distinct flaws were identified in the same code path or module during security review or incident response.
Frequently Asked Questions
What is CVE-2025-21335?
CVE-2025-21335 is a high-severity elevation of privilege vulnerability in the Windows Hyper-V NT Kernel Integration Virtualization Service Provider. It allows a local attacker with low privileges to escalate to SYSTEM-level access on affected Windows 10, Windows 11, and Windows Server systems. Microsoft patched it in the January 2025 security update.
Am I affected if I don't use Hyper-V virtual machines?
You may still be affected. The Hyper-V kernel integration component can be active on systems that use Hyper-V-based security features such as Credential Guard, Device Guard, Windows Sandbox, or Windows Subsystem for Linux 2 (WSL 2). Check if the Hyper-V feature is enabled in Windows Features or use the command "systeminfo" to verify the hypervisor status.
How is CVE-2025-21335 related to CVE-2025-21333 and CVE-2025-21334?
All three CVEs affect the same Hyper-V NT Kernel Integration VSP component and share identical CVSS scores of 7.8. They were disclosed together in Microsoft's January 2025 Patch Tuesday and are all listed in CISA's KEV catalog. While each represents a distinct vulnerability, they target the same kernel driver and are remediated by the same cumulative update.
What should I prioritize when patching CVE-2025-21335?
Prioritize Hyper-V hosts running production virtual machines and domain controllers first, as these represent the highest-impact targets. Follow with workstations that have Hyper-V features enabled. Apply the January 2025 Cumulative Update and ensure systems are rebooted afterward, as the fix operates at the kernel level and requires a restart to take effect.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.