Microsoft Windows Hyper-V NT Kernel Integration VSP Use-After-Free (CVE-2025-21335)

Historical catalog analysis: CISA added this entry on January 14, 2025. The entry reflects catalog information retrieved on August 31, 2026, not a snapshot archived on the inclusion date. Check current vendor guidance before acting.

What the vulnerability is

CVE-2025-21335 is a use-after-free vulnerability (CWE-416) located within the Microsoft Windows Hyper-V NT Kernel Integration VSP. This flaw allows an attacker with local access to the system to escalate their privileges to the SYSTEM level, providing full administrative control over the affected host.

Exposure and applicability

This vulnerability specifically affects environments utilizing the Windows Hyper-V NT Kernel Integration VSP. The primary exposure path is local; an attacker must already have a foothold on the system to trigger the use-after-free condition. Organizations running virtualized workloads via Hyper-V should prioritize identifying hosts where this specific kernel integration component is active.

Remediation priorities

Based on our analysis, remediation should be prioritized for high-value Hyper-V hosts that support multi-tenant environments or those with lower barriers to local access.

1. Apply Vendor Mitigations: The primary corrective action is the application of updates provided by Microsoft. This is the most direct method to resolve the underlying memory management error.
2. Product Decommissioning: In scenarios where vendor mitigations cannot be applied or are unavailable for a specific legacy configuration, the source indicates that discontinuing use of the product is a necessary alternative to eliminate the exposure.
3. Privilege Restriction: While not a fix for the vulnerability itself, restricting local access to Hyper-V hosts could reduce the likelihood of an attacker being in a position to exploit this flaw.

How to validate remediation

Verification must go beyond a simple version check. To ensure that exposure has been reduced, defenders should:
* Verify Patch Application: Confirm through system update logs or configuration management tools that the specific security update addressing CVE-2025-21335 has been successfully installed and initialized.
* Configuration Audit: For systems where the product was discontinued to mitigate risk, verify that the Hyper-V NT Kernel Integration VSP is no longer active or accessible in the environment.

Limits and open questions

It remains unknown whether this vulnerability has been utilized by ransomware campaigns. Furthermore, while CISA has established a remediation deadline of February 4, 2025, for federal agencies, this date serves as a benchmark for urgency rather than a mandatory requirement for non-federal organizations. Residual risk persists if the update is applied but the system remains vulnerable to other local privilege escalation vectors not addressed by this specific patch.

Source and editorial note

CVE-2025-21335: Microsoft Windows Hyper-V NT Kernel Integration VSP Use-After-Free Vulnerability · Source date: January 14, 2025 · Retrieved August 31, 2026.

Material facts are tied to the cited primary source. Recommendations are independent defensive analysis unless attributed to the source. Confirm consequential decisions against current authoritative guidance.

Archive date: January 17, 2025. The displayed post date is assigned three days after the source date to organize this retrospective archive; it does not mean this site published the analysis then. First published by this site: October 28, 2026 at 00:29 UTC.

Request a Vulnerability Assessment