CVE-2025-21335: Microsoft Windows Hyper-V NT Kernel Integration VSP Use-After-Free Vulnerability

CVE-2025-21335 is a use-after-free vulnerability in the Microsoft Windows Hyper-V NT Kernel Integration VSP component. A local attacker can exploit it to gain SYSTEM privileges on the affected host.

This matters for IT and security teams because Hyper-V underpins virtualization on many Windows systems. Successful privilege escalation to SYSTEM can give an attacker full control of the host, enabling lateral movement, persistence, or compromise of guest virtual machines. Confirm all details against the vendor advisory before acting.

How it works

The flaw is classified as CWE-416, a use-after-free condition. In this class of weakness, a program frees a block of memory but later continues to reference or write to that same location. An attacker who can influence the timing and content of those references may corrupt kernel structures or redirect execution flow.

According to the available summary, the issue resides in the Hyper-V NT Kernel Integration VSP. A local attacker with the ability to interact with this component can trigger the use-after-free and elevate privileges to SYSTEM. Exact exploit mechanics, required access rights short of local presence, and any race conditions are not detailed in the public record; teams must treat the vulnerability as a local privilege-escalation risk and verify specifics in the Microsoft advisory.

Am I affected? How to find it in your systems

The vulnerability affects Microsoft Windows systems that include the Hyper-V NT Kernel Integration VSP. Hyper-V is commonly enabled on Windows Server hosts used for virtualization, on Windows client machines running local virtual machines, and in some nested or cloud-hosted Windows environments.

• Inventory every Windows host that has the Hyper-V role or feature installed. Use PowerShell cmdlets such as Get-WindowsFeature or Get-WindowsOptionalFeature, or query the registry and service lists for Hyper-V related components.
• Identify the exact Windows build and patch level of each host. Because no specific version ranges are supplied here, compare those builds against the list published in the vendor advisory for CVE-2025-21335.
• Review configuration: note whether the NT Kernel Integration VSP is active, whether guests are running, and whether the host is domain-joined or internet-facing.
• For detection of possible exploitation, examine security event logs and kernel audit trails for unexpected process creations running as SYSTEM, anomalous Hyper-V service restarts, or memory-related crash dumps that coincide with local user activity. Endpoint detection and response tools that monitor for privilege-escalation patterns can surface related telemetry. Absence of such signs does not prove the system is clean.

How to remediate

The primary remediation is to apply the security update provided by Microsoft for this vulnerability. Follow the vendor’s installation instructions exactly, including any required reboots and any prerequisites listed in the advisory.

• Test the update in a representative non-production environment first, especially on hosts that run production virtual machines.
• After deployment, verify the patch level matches the fixed builds listed by Microsoft.
• As a general hardening step for this class of kernel use-after-free issues, keep Hyper-V and related integration services current, limit local administrative accounts, and enforce least-privilege for any accounts that can interact with virtualization components.
• If the product cannot be patched and no mitigations exist, the CISA-required action is to discontinue use of the affected component.

If you can't patch immediately

Until the vendor update can be applied, reduce the attack surface with compensating controls.

• Segment Hyper-V hosts onto isolated management networks; restrict local logon and remote management to a small set of trusted administrative workstations.
• Disable the Hyper-V role or the specific NT Kernel Integration VSP feature on systems that do not require virtualization. Confirm the impact on any dependent workloads first.
• Apply host-based firewall rules and application control policies that limit which processes can interact with Hyper-V services.
• Increase monitoring: enable detailed auditing of privilege use, process creation, and Hyper-V operational events; forward those logs to a SIEM and alert on anomalies consistent with local privilege escalation.
• Virtual patching via a host-based intrusion-prevention system or kernel-level filter may be possible for some use-after-free patterns, but effectiveness must be validated against the vendor’s description of the flaw.

These measures lower risk but do not eliminate it; schedule the official patch as soon as operationally feasible.

If your data may have been exposed

Actively exploited vulnerabilities can lead to full host compromise and subsequent data breaches. Although ransomware use of this specific CVE is not documented, any successful elevation to SYSTEM warrants investigation for unauthorized access, credential theft, or data exfiltration. Review host and network logs for indicators of post-exploitation activity. As a further check, individuals can run a free exposure scan of their email addresses against known breach data sets to determine whether personal credentials have appeared in prior incidents.