CVE-2025-21334: Windows Hyper-V NT Kernel Integration VSP use-after-free privilege escalation

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: medium.

high priorityThe flaw is a local privilege escalation with high impact on confidentiality, integrity and availability, and it is listed in CISA KEV as exploited in the wild, though EPSS probability is modest and no ransomware use is documented.

What it is

CVE-2025-21334 is a use-after-free (CWE-416) in the Windows Hyper-V NT Kernel Integration VSP that allows an attacker to elevate privileges. It affects a broad set of Windows 10, Windows 11 and Windows Server builds, and Microsoft has released a patch. Because it is listed in CISA KEV, it should be treated as an actively exploited flaw rather than a theoretical one.

Impact

A local attacker who already has low privileges can exploit the memory corruption to gain high-level code execution in the kernel context, giving full control of confidentiality, integrity and availability on the affected host.

Attack surface

The CVSS vector is local (AV:L) with low attack complexity, low privileges required and no user interaction, so the flaw is reached by a local user or process on the target system rather than over the network. No authentication beyond the existing low-privileged session is needed.

Exploitation

CVE-2025-21334 was added to CISA KEV on 2025-01-14 with a remediation due date of 2025-02-04, indicating known exploitation in the wild. EPSS gives a 30-day probability of 0.01561 (73.98th percentile), and no ransomware campaign use is documented.

What to do

• Apply the Microsoft security update for CVE-2025-21334 to all affected Windows 10, Windows 11 and Windows Server builds as the first action.
• If patching cannot be completed immediately, follow the vendor mitigation guidance or discontinue use of the affected Hyper-V component per CISA's required action.
• Restrict local logon and interactive access on Hyper-V hosts to trusted administrators to reduce the pool of low-privileged users who can reach the VSP.
• Audit Hyper-V host and guest configurations and remove or disable the NT Kernel Integration VSP where it is not operationally required.
• Track the CISA KEV due date of 2025-02-04 and confirm remediation across all affected hosts before that deadline.

Detection

• Monitor for unexpected process crashes or memory corruption events in Hyper-V-related processes and the NT kernel on Hyper-V hosts.
• Alert on privilege-escalation behavior such as low-privileged processes spawning SYSTEM-level children or loading kernel drivers unexpectedly.
• Review Windows event logs and EDR telemetry for suspicious activity originating from Hyper-V VSP components on affected builds.
• Hunt for known exploitation artifacts tied to CVE-2025-21334 using vendor advisories and threat intelligence feeds, since no specific IOC list is provided in this record.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.