Loading vulnerability…
Use-after-free privilege escalation in Windows Hyper-V NT Kernel Integration VSP
CVE-2025-21335 is a use-after-free vulnerability in Windows Hyper-V NT Kernel Integration VSP that allows a low-privileged local attacker to gain SYSTEM privileges without user interaction. The affected component supports communication between the host operating system and container-type virtual machines, including Windows Sandbox and Microsoft Defender Application Guard, and is not present in traditional Hyper-V VM environments. The vulnerability is not a guest-to-host escape. It was actively exploited when Microsoft released security updates in January 2025.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation elevates a low-privileged local attacker to SYSTEM, potentially compromising the affected system's confidentiality, integrity, and availability. Exploitation does not provide a guest-to-host escape.
If you can’t patch tonight, do this now.
No specific workaround is available in the provided information beyond applying Microsoft's security updates and following vendor guidance for affected Hyper-V and Windows systems. As a risk-reduction measure pending patching, limit exposure of Hyper-V hosts to untrusted workloads and restrict local or guest access paths that could provide an attacker with an initial foothold.
Patch, then assume compromise.
Apply the Microsoft security updates addressing CVE-2025-21335, released in the January 14, 2025 security update cycle. Microsoft recommends updating to the latest version of Windows. Specific affected versions, fixed builds, and update identifiers are currently not available.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
4 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.