CVE-2025-21335: Windows Hyper-V NT Kernel Integration VSP use-after-free privilege escalation

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: medium.

high priorityIt is in CISA KEV with confirmed exploitation and a CVSS of 7.8, but requires local low-privilege access, which limits reach.

What it is

CVE-2025-21335 is a use-after-free (CWE-416) in the Windows Hyper-V NT Kernel Integration VSP. A local attacker with low privileges can exploit it to elevate to higher privileges on affected Windows 10, Windows 11 and Windows Server systems. It was added to CISA KEV on 2025-01-14, indicating known exploitation in the wild.

Impact

Successful exploitation gives the attacker elevated privileges on the host, potentially full control of the affected system. Because the flaw is in the Hyper-V integration component, compromise can cross the guest-to-host boundary.

Attack surface

The CVSS vector is AV:L/PR:L/UI:N, so the attacker needs local access and low privileges on the target, with no user interaction. It is not remotely reachable and does not require authentication beyond the low-privilege foothold.

Exploitation

CISA added it to KEV on 2025-01-14 with a 2025-02-04 remediation due date, confirming known exploitation. EPSS is 0.0139 (70.9th percentile), and no ransomware campaign use is documented.

What to do

• Apply the Microsoft patch from the MSRC update guide for CVE-2025-21335 immediately.
• If patching is not possible, follow CISA's required action to apply vendor mitigations or discontinue use of the affected product.
• Restrict local logon and interactive access on Hyper-V hosts to trusted administrators only.
• Audit and minimize low-privilege accounts and services that can run on Hyper-V hosts.
• Track the CISA KEV due date of 2025-02-04 to confirm remediation.

Detection

• Monitor for unexpected privilege escalation or token manipulation on Hyper-V hosts.
• Look for unusual process creation or crashes in Hyper-V integration/VSP-related processes.
• Alert on local logon activity by low-privilege accounts on Hyper-V hosts outside normal patterns.
• Review host and Hyper-V event logs for anomalies around the time of suspected exploitation.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.