Loading vulnerability…
A heap-based buffer overflow vulnerability in the Windows Hyper-V NT Kernel Integration Virtualization Service Provider (VSP) can allow elevation of privilege across the guest-host trust boundary. Available reporting indicates the flaw is triggered by a malicious request delivered through the Hyper-V VSP interface that uses an oversized buffer, leading to heap corruption in the host-side kernel component. Public discussion of exploitation describes an attacker starting from a child virtual machine or Windows Sandbox instance, grooming heap state, and causing an overwrite of an adjacent kernel object, ultimately achieving code execution in the host context as SYSTEM. The vulnerability was reported as actively exploited in the wild at the time of patch release.
Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.
What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
If you can’t patch tonight, do this now.
Patch, then assume compromise.
5 valid exploits after Mallory filtered fakes, detection scripts, and README-only repos (2 hidden).
Repository contains a Windows local privilege escalation PoC for CVE-2025-21333, a heap-based buffer overflow in the Hyper-V NT Kernel Integration VSP component vkrnlintvsp.sys. Structure is minimal: one large C++ exploit source file (main logic), one small Hexdump helper header, a README documenting vulnerability details and lab-specific adjustments, and .gitattributes. The exploit is not part of a common framework. The main file, CVE-2025-21333-POC.cpp, is a standalone Windows-native exploit using low-level APIs and headers such as Windows.h, ioringapi.h, DbgEng.h, aclapi.h, UserEnv.h, and WNF-related definitions. It implements a full exploitation chain rather than mere detection. Based on constants and comments, it is tuned for Windows 11 23H2 build 22631.3447 and uses hardcoded kernel structure offsets (EPROCESS fields, token privilege offsets, ntoskrnl and NPFS offsets). This indicates strong build dependence. Core capability: the exploit performs heap grooming with large WNF state sprays, triggers the vulnerable path using a crafted oversized ACL, corrupts adjacent WNF state data, frees selected allocations to create holes, and reclaims them with IoRing registered buffers (IrRB) and named pipe attributes (NpAt). It then overwrites a RegBuffers entry so an IoRing object references a user-controlled fake IOP_MC_BUFFER_ENTRY, yielding arbitrary kernel read/write. With that primitive, it locates process/token structures and modifies token data to elevate privileges to SYSTEM. The README states successful exploitation can produce a visible SYSTEM shell using CreateProcessAsUser with TokenSessionId and winsta0\Default. Fingerprintable targets/endpoints in code are local named pipes \\.\pipe\IoRingExploitOutput and \\.\pipe\IoRingExploitInput, used during the pipe spray/reallocation phase. No external C2, remote network targets, or internet callbacks are present; this is a purely local kernel exploit. The README also references Windows Sandbox as a prerequisite because the vulnerable syscall path must reach vkrnlintvsp.sys through Cross-VM event creation. Overall, this is an operational lab PoC for local exploitation on specific vulnerable Windows builds, not a weaponized framework module. It includes a real payload path (kernel arbitrary read/write leading to SYSTEM token manipulation), but customization is manual and environment-specific.
Repository is a standalone Windows local kernel exploit for CVE-2025-21333, not tied to a common exploitation framework. Structure is small and focused: README.md documents the exploit approach and references an earlier PoC; exp/build.bat compiles the project with MSVC; exp/main.cpp contains the main exploitation flow; exp/helper.c and exp/helper.h implement NT API loading, heap spraying helpers, WNF manipulation, pipe/IoRing primitives, and kernel read/write support; exp/hexdump.c and exp/hexdump.h provide debugging output. The exploit targets Windows kernel heap corruption. Based on the code and README, it improves on an earlier public PoC by using Microsoft Defender Application Guard / IsolatedAppLauncher APIs to obtain a sandbox/container GUID instead of opening a Windows Sandbox process. The main flow in exp/main.cpp loads NT functions from ntdll.dll, obtains the container GUID, raises process/thread priority, sprays large numbers of WNF state objects into paged pool, frees selected WNF objects to create holes, crafts oversized ACL-backed object data to overflow into adjacent allocations, and then pivots into pipe attribute and IoRing object corruption. The helper code shows the intended post-corruption capabilities: arbitrary kernel read via fake/corrupted pipe_attribute structures and arbitrary kernel read/write via forged IoRing-related IOP_MC_BUFFER_ENTRY state. Hardcoded kernel offsets in helper.h (for NPFS and nt offsets such as PsInitialSystemProcess and PoolQuotaCookie) indicate the exploit is tuned to specific Windows kernel builds and is not broadly portable without adjustment. Named pipes \\.\pipe\IoRingExploitInput and \\.\pipe\IoRingExploitOutput are explicit local endpoints used during exploitation. Overall, this is an operational local privilege-escalation style exploit with real exploitation primitives rather than a mere detector or crash PoC.
This repository contains a working proof-of-concept (POC) exploit for CVE-2025-21333, a heap-based buffer overflow vulnerability in the Windows Hyper-V NT Kernel Integration Virtualization Service Provider (VSP). The exploit is implemented in C++ (main file: CVE-2025-21333.cpp) and is designed to be compiled and run on a vulnerable Windows system. The exploit leverages advanced manipulation of Windows kernel objects, including the Windows Notification Facility (WNF), named pipes, and process tokens, to achieve local privilege escalation from a low-privileged user or VM context to SYSTEM on the Hyper-V host. The README provides detailed background, affected systems, and usage instructions, including how to verify vulnerable binaries and run the exploit. The exploit uses named pipes (\\.\pipe\IoRingExploitOutput and \\.\pipe\IoRingExploitInput) for communication and targets specific system files (vkrnlintvsp.sys and ntoskrnl.exe) for fingerprinting and exploitation. The codebase includes supporting header files (Hexdump.hpp, wnf.h) and Visual Studio project files for building the exploit. This is a mature, operational exploit that provides a SYSTEM shell if successful.
This repository contains a functional proof-of-concept (POC) exploit for CVE-2025-21333, a heap-based buffer overflow in the Windows Hyper-V NT Kernel Integration Virtualization Service Provider (VSP). The exploit is implemented in C++ and is structured as a Visual Studio project, with the main logic in 'CVE-2025-21333.cpp' and supporting headers ('Hexdump.hpp', 'wnf.h'). The exploit leverages advanced Windows kernel features, including the Windows Notification Facility (WNF), IO rings, and named pipes, to manipulate kernel memory and escalate privileges from a VM context to SYSTEM on the Hyper-V host. The README provides detailed background, affected systems, and usage instructions, including example output showing successful SYSTEM shell access. The exploit targets unpatched Windows 10/11 and Server 2022/2025 Hyper-V hosts and requires local access from a VM. Notable fingerprintable endpoints include named pipes (\\.\pipe\IoRingExploitOutput, \\.\pipe\IoRingExploitInput) and references to key system files (vkrnlintvsp.sys, ntoskrnl.exe) for version/hash checking. The code is operational and demonstrates a full privilege escalation chain, making it a high-impact exploit for vulnerable environments.
This repository is a Proof-of-Concept (POC) exploit for CVE-2025-21333, a heap-based buffer overflow vulnerability in the Windows driver vkrnlintvsp.sys. The exploit is implemented in C++ and is structured as a Visual Studio project, with the main logic in 'CVE-2025-21333-POC.cpp' and supporting headers. The exploit works by manipulating kernel memory structures (specifically, an array of pointers to _IOP_MC_BUFFER_ENTRY) to achieve arbitrary kernel read/write via I/O Ring syscalls. It then leverages this primitive to steal the SYSTEM token and spawn a SYSTEM shell, providing local privilege escalation on Windows 11 23H2 (and possibly 24H2) with the vulnerable driver and Windows Sandbox enabled. The README provides detailed technical background, requirements, hashes of tested binaries, and step-by-step usage instructions. The exploit is not weaponized and is intended for research and demonstration purposes. Notable fingerprintable endpoints include the vulnerable driver path, kernel binary, and named pipes used for exploit communication.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.
11 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
An exploited-in-the-wild Hyper-V Virtualization Service Provider (VSP) kernel vulnerability enabling elevation of privilege to SYSTEM from a guest/contained context via memory corruption (heap grooming + oversized buffer overwrite).
A Windows Hyper-V NT Kernel Integration VSP elevation of privilege vulnerability that Microsoft reports is being actively exploited in the wild.
A Windows Hyper-V NT Kernel Integration VSP elevation-of-privilege vulnerability that Microsoft reports is actively exploited in the wild.
A critical elevation of privilege vulnerability in Microsoft Hyper-V that allows a guest VM to escape to the host, breaking virtualization boundaries.
Query your assets running an affected version, and investigate the blast radius.
Every observed campaign linking this CVE to a named adversary.
Malware families riding this exploit, with evidence and IOCs.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Cross-references every affected SKU, including bundled OEM variants.
Community discussion across Reddit, Mastodon, and other social sources.