Windows Hyper-V NT Kernel Integration VSP Elevation of Privilege Vulnerability

cisa required action Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

1. 2025-01-14 Added to CISA KEV
2. 2025-01-14 Published
3. 2025-01-23 CISA SSVC: exploitation active
4. 2025-02-04 CISA patch deadline
5. 2025-09-16 First public exploit (EDB-52436)

Added

21 mo ago (2025-01-14)

Patch by

2025-02-04 (21 mo ago)

Ransomware

Not known

Required action

Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

Vendor, product

Microsoft, Windows

CISA name

Microsoft Windows Hyper-V NT Kernel Integration VSP Heap-based Buffer Overflow Vulnerability

How it is exploited and what it leads to, in MITRE ATT&CK terms.

• T1068 Exploitation for Privilege Escalation exploitation
• T1003 OS Credential Dumping primary impact

kev release 2025-07-28, att&ck v16.1. KEV to ATT&CK mappings by the MITRE Center for Threat-Informed Defense (Mappings Explorer, Apache-2.0). © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. Terms of use

Exploitation

Active, exploited in the wild

Automatable

no

Technical impact

total

Assessed

21 mo ago (2025-01-23)

10.07% chance of exploitation in the next 30 days, higher than 95% of all scored CVEs (FIRST EPSS, 2026-11-08).

• EDB-52436 Microsoft Windows Server 2025 Hyper-V NT Kernel Integration VSP - Elevation of Privilege local, 2025-09-16

• Microsoft Windows 10 Version 21H2
• Microsoft Windows 10 Version 22H2
• Microsoft Windows 11 version 22H2
• Microsoft Windows 11 version 22H3
• Microsoft Windows 11 Version 23H2
• Microsoft Windows 11 Version 24H2
• Microsoft Windows Server 2022, 23H2 Edition (Server Core installation)
• Microsoft Windows Server 2025
• Microsoft Windows Server 2025 (Server Core installation)

Weakness

• CWE-122 Heap-based Buffer Overflow

• msrc.microsoft.com /update-guide/vulnerability/CVE-2025-21333

  vendor-advisory, patch

• exploit-db.com /exploits/52436

  exploit, third-party-advisory, vdb-entry

• cisa.gov /known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-21333

  government-resource, us-government-resource

• vicarius.io /vsociety/posts/cve-2025-21333-elevated-privilege-exposure-in-windows-hyper-v-by-microsoft-mitigation-script

  mitigation, third-party-advisory

• vicarius.io /vsociety/posts/cve-2025-21333-elevated-privilege-exposure-in-windows-hyper-v-by-microsoft-detection-script

  mitigation, third-party-advisory

• CVE List CVE-2025-21333
• NVD CVE-2025-21333

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.