Loading vulnerability…
Use-after-free privilege escalation in Windows Hyper-V NT Kernel Integration VSP
CVE-2025-21334 is a use-after-free vulnerability in the Windows Hyper-V NT Kernel Integration Virtual Service Provider (VSP) that allows a low-privileged local attacker to obtain SYSTEM privileges without user interaction. The component supports communication between the host operating system and container-type virtual machines, including Windows Sandbox and Microsoft Defender Application Guard, rather than traditional Hyper-V virtual machines. The vulnerability was actively exploited when Microsoft released its January 2025 security updates. It is not a guest-to-host escape vulnerability.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation elevates a low-privileged local attacker to SYSTEM, potentially compromising the affected system's confidentiality, integrity, and availability. The vulnerability does not provide a guest-to-host escape.
If you can’t patch tonight, do this now.
No specific workaround is available in the provided information beyond applying Microsoft's security updates. As a risk-reduction measure pending patching, minimize exposure of Hyper-V-enabled systems, restrict administrative and local access to affected hosts, and limit opportunities for attackers to obtain an initial foothold that could be used to trigger local privilege escalation.
Patch, then assume compromise.
Apply Microsoft's January 14, 2025 security updates for affected Windows products, or subsequent updates containing the fix, and update to the latest supported Windows version. Specific fixed builds and update package identifiers are not available.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
4 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.