CVE-2025-21333: Windows Hyper-V NT Kernel Integration VSP heap buffer overflow privilege escalation

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: high.

high priorityThe flaw is a locally exploitable privilege escalation with high confidentiality, integrity and availability impact, is listed in CISA KEV with a public exploit, and affects widely deployed Windows and Windows Server builds.

What it is

CVE-2025-21333 is a heap-based buffer overflow in the Windows Hyper-V NT Kernel Integration VSP. A local attacker with low privileges can trigger the overflow to elevate to higher privileges on the host. It affects multiple Windows 10, Windows 11 and Windows Server builds and is listed in CISA KEV, so it warrants prompt patching.

Impact

An attacker who successfully exploits the overflow gains elevated privileges on the affected Windows system, with high impact to confidentiality, integrity and availability. Because the flaw sits in the Hyper-V integration component, compromise can extend beyond a guest to the host environment.

Attack surface

The CVSS vector is local (AV:L), low complexity, low privileges required and no user interaction, so the flaw is reached by an attacker already running code on the target rather than remotely. No authentication beyond the existing low-privileged local session is needed.

Exploitation

CVE-2025-21333 was added to CISA KEV on 2025-01-14 with a 2025-02-04 remediation due date, and a public Exploit-DB entry exists, indicating known exploitation. EPSS gives a 30-day probability of roughly 10 percent (95th percentile), and no ransomware campaign use is documented.

What to do

• Apply the Microsoft security update for CVE-2025-21333 to all affected Windows 10, Windows 11 and Windows Server builds as the first action.
• Follow CISA KEV required action: apply vendor mitigations or discontinue use of the product where mitigations are unavailable.
• Restrict and monitor local interactive access and low-privileged accounts on Hyper-V hosts to reduce the attack surface.
• Review Hyper-V and VSP configuration and apply any additional vendor hardening guidance for the integration service.

Detection

• Monitor for exploitation attempts against the Hyper-V NT Kernel Integration VSP, for example unusual local process behavior or crashes in Hyper-V related components.
• Hunt for local privilege escalation activity on Hyper-V hosts, including unexpected token or privilege changes by low-privileged processes.
• Use the vendor and third-party detection and mitigation scripts referenced for CVE-2025-21333 to check host exposure and confirm patch state.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.