CVE-2025-21335

What it actually does

CVE-2025-21335 is a Windows Hyper-V NT Kernel Integration VSP elevation-of-privilege vulnerability caused by a use-after-free condition. A local attacker who can execute code on an affected Windows system can trigger unsafe memory reuse in the Hyper-V integration component and escalate privileges, potentially obtaining kernel-level or SYSTEM-level execution. The flaw does not provide initial remote access by itself; it is most dangerous when chained after phishing, drive-by compromise, stolen credentials, or exploitation of another vulnerability that gives the attacker a foothold.

Why it matters to the business

Successful exploitation can turn a limited compromise into full control of a Windows host, allowing attackers to disable security tooling, dump credentials, move laterally, tamper with workloads, and persist. Because this vulnerability is listed in CISA KEV and has active in-the-wild exploitation, remediation should be treated as urgent even though the EPSS score is relatively low. Organizations subject to CISA guidance had a remediation deadline of 2025-02-04. Systems running Hyper-V roles or Hyper-V integration components are higher priority because compromise may affect virtualization infrastructure and hosted workloads.

How an attack unfolds

An attacker first needs local code execution on an affected Windows system, typically through malware execution, a compromised user account, remote access tooling, or a separate initial-access vulnerability. Once present, the attacker runs exploit code that interacts with the vulnerable Hyper-V NT Kernel Integration VSP component and triggers the use-after-free condition. By shaping memory allocation and reuse, the exploit can corrupt kernel memory or gain privileged execution. After privilege escalation, the attacker can run commands as SYSTEM or equivalent high privilege, disable defenses, access sensitive credentials, install persistence, and use the host as a staging point for lateral movement. Public reporting and KEV status indicate this issue has been exploited in the wild, so post-compromise investigation is warranted on exposed or unpatched systems.

How to fix it

Apply the Microsoft security updates released for this vulnerability, beginning with the January 2025 Patch Tuesday updates, to all affected Windows systems. Prioritize Hyper-V hosts, virtualization infrastructure, Windows servers, systems used by administrators, and endpoints with elevated business criticality. If immediate patching is not possible, reduce exposure by limiting local logon and remote interactive access, restricting who can access Hyper-V-enabled systems, enforcing least privilege, enabling endpoint detection and response controls, and increasing monitoring for privilege-escalation behavior. There are no safe compensating controls that should be considered equivalent to patching for a KEV-listed local privilege-escalation vulnerability.

How to confirm the fix worked

Confirm that the relevant Microsoft cumulative update or security-only update for January 2025 or later is installed on each applicable Windows version. Validate through enterprise patch management, Windows Update history, Microsoft Update Catalog package inventory, or commands such as `Get-HotFix` / `wmic qfe` where appropriate. Confirm that Hyper-V hosts and systems with Hyper-V components have rebooted successfully after patch installation. Vulnerability scanners should no longer report CVE-2025-21335 after the applicable update is installed. For high-risk systems, also verify that endpoint protection remains enabled, Hyper-V services are running normally, and no unexpected privileged accounts, services, scheduled tasks, drivers, or startup entries appeared before remediation.

Typical attack path

1. Gain initial local execution on an affected Windows host through phishing, malware, stolen credentials, exposed remote access, or another vulnerability.
2. Run exploit code targeting the Hyper-V NT Kernel Integration VSP use-after-free condition.
3. Manipulate kernel memory state to elevate from a low-privileged context to SYSTEM or kernel-level execution.
4. Disable or tamper with endpoint security controls and logging where possible.
5. Dump credentials, access protected data, or modify privileged system configuration.
6. Establish persistence and use the compromised host for lateral movement or further attacks.

How to detect it

There is no single reliable log string that proves exploitation of this vulnerability, so detection should focus on post-exploitation behavior and host telemetry from systems that were unpatched. Review Windows Security logs, Sysmon logs, PowerShell logs, EDR process telemetry, driver-load events, service-creation events, scheduled-task events, and Hyper-V-related operational logs. Look for low-privileged user processes that quickly transition to SYSTEM-level execution, unexpected child processes launched with SYSTEM integrity, abnormal creation of services or scheduled tasks, credential dumping attempts, LSASS access, unsigned or unusual kernel driver loads, disabling of security tools, clearing of event logs, or sudden changes to local administrators. On Hyper-V hosts, correlate suspicious activity with Hyper-V service and integration-component events. Because this is a privilege-escalation flaw, exploitation is usually preceded by a separate initial-access event; investigate suspicious logons, remote execution, malware alerts, and unusual file drops before the privilege escalation activity. Threat intelligence should treat KEV status and active exploitation as sufficient reason to hunt even where EPSS remains low.

What your security team should do

• Treat this as urgent because it is CISA KEV-listed and has active in-the-wild exploitation; confirm remediation status across all Windows assets, especially Hyper-V hosts and administrator workstations.
• Patch affected systems with the applicable January 2025 or later Microsoft security update and verify successful reboot and installation.
• Hunt for suspicious local privilege-escalation activity on systems that were unpatched after publication, especially before the CISA KEV due date of 2025-02-04.
• Review EDR telemetry for low-privileged processes spawning SYSTEM-level shells, unexpected driver loads, security-tool tampering, credential dumping, or abnormal Hyper-V component interaction.
• Prioritize forensic review for systems where exploit-like behavior is observed, because privilege escalation often follows an initial compromise.
• Restrict interactive logon, remote desktop, PowerShell remoting, and administrative access to Hyper-V hosts to only required administrators.
• Ensure credential protections are enabled where feasible, including LSASS protection, Credential Guard, attack-surface-reduction rules, and tamper protection.
• After patching, rotate credentials that may have been exposed on systems showing signs of compromise.