CVE-2025-21335KEV · OVERDUECWE-416

Microsoft Windows Hyper-V NT Kernel Integration VSP Use-After-Free Vulnerability

High · published January 14, 2025

Patch now

Confirmed exploited, and the score agrees

CVSS calls it high at 7.8. It is confirmed in active exploitation. It sits in the 72.3th percentile for exploit probability.

627
days past CISA
deadline
CVSS v3.1
7.8
EPSS
1%
Percentile
72.3
In the wild
Confirmed
What it is

🚨 A crafty elevation of privilege vulnerability in Windows Hyper-V could let attackers take control of your virtual machines like a magician pulling a rabbit out of a hat! 🔥 Think of it as a backstage pass at a concert — if someone manages to sneak in, they can access all the areas and do whatever they want, even if they were only supposed to be in the audience! This vulnerability could allow a malicious actor to escalate their privileges and gain the same level of control as an administrator, potentially leading to data breaches or complete system takeover. The consequences could be absolutely devastating, exposing sensitive information and disrupting operations.

Put simply

Think of it as a backstage pass at a concert — if someone manages to sneak in, they can access all the areas and do whatever they want, even if they were only supposed to be in the audience! This vulnerability lies in the Windows Hyper-V NT Kernel Integration, allowing attackers to exploit flaws in the virtualization stack and gain elevated privileges without authorization.

What to do

This vulnerability could allow a malicious actor to escalate their privileges and gain the same level of control as an administrator, potentially leading to data breaches or complete system takeover. The consequences could be absolutely devastating, exposing sensitive information and disrupting operations. To protect yourself, update your Windows systems immediately to the latest version available, which addresses this vulnerability. Regularly monitor and apply security patches to ensure your systems are fortified against potential exploits. 🔒 You've got this! Stay vigilant and follow these steps to keep your systems secure! 🛡️

The record
Technical detail
CVSS v3.1
7.8 · HIGH
Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.01401 · 72.3th percentile
Weakness
CWE-416 · Use After Free
Published
2025-01-14T23:15Z
KEV added
2025-01-14 · due 2025-02-04
Affected products (10)
ProductVersionsFixed in
microsoft/windows_10_21h2< 10.0.19044.537110.0.19044.5371
microsoft/windows_10_22h2< 10.0.19045.537110.0.19045.5371
microsoft/windows_11_22h2< 10.0.22621.475110.0.22621.4751
microsoft/windows_11_22h2< 10.0.22621.475110.0.22621.4751
microsoft/windows_11_23h2< 10.0.22631.475110.0.22631.4751
microsoft/windows_11_23h2< 10.0.22631.475110.0.22631.4751
microsoft/windows_11_24h2< 10.0.26100.289410.0.26100.2894
microsoft/windows_11_24h2< 10.0.26100.289410.0.26100.2894
microsoft/windows_server_2022_23h2< 10.0.25398.136910.0.25398.1369
microsoft/windows_server_2025< 10.0.26100.289410.0.26100.2894
References (2)
EPSS history
Timeline
  • 14 JAN 18:04Z
    Windows Hyper-V NT Kernel Integration VSP Elevation of Privilege Vulnerability
    cvelistv5
  • 14 JAN 00:00Z
    Added to CISA KEV — remediate by Feb 4
    kev