Windows Hyper-V NT Kernel Integration VSP Elevation of Privilege Vulnerability (CVE-2025-21333)

What is affected, what to do

Windows Hyper-V NT Kernel Integration VSP Elevation of Privilege Vulnerability

The vulnerability is being actively exploited; treat it as a priority. Update Microsoft Windows 10 Version 21H2 to version 10.0.19044.5371, Microsoft Windows 10 Version 22H2 to version 10.0.19045.5371, Microsoft Windows 11 version 22H2 to version 10.0.22621.4751. Immediate actions, mitigation and detection rules are in the runbook below.

Affected

• Microsoft Windows 10 Version 21H2 lt 10.0.19044.0..10.0.19044.5371
• Microsoft Windows 10 Version 22H2 lt 10.0.19045.0..10.0.19045.5371
• Microsoft Windows 11 version 22H2 lt 10.0.22621.0..10.0.22621.4751
• Microsoft Windows 11 version 22H3 lt 10.0.22631.0..10.0.22631.4751
• Microsoft Windows 11 Version 23H2 lt 10.0.22631.0..10.0.22631.4751
• Microsoft Windows 11 Version 24H2 lt 10.0.26100.0..10.0.26100.2894
• Microsoft Windows Server 2022, 23H2 Edition (Server Core installation) lt 10.0.25398.0..10.0.25398.1369
• Microsoft Windows Server 2025 lt 10.0.26100.0..10.0.26100.2894
• Microsoft Windows Server 2025 (Server Core installation) lt 10.0.26100.0..10.0.26100.2894

Fixed in

• Microsoft Windows 10 Version 21H2 10.0.19044.5371
• Microsoft Windows 10 Version 22H2 10.0.19045.5371
• Microsoft Windows 11 version 22H2 10.0.22621.4751
• Microsoft Windows 11 version 22H3 10.0.22631.4751
• Microsoft Windows 11 Version 23H2 10.0.22631.4751
• Microsoft Windows 11 Version 24H2 10.0.26100.2894
• Microsoft Windows Server 2022, 23H2 Edition (Server Core installation) 10.0.25398.1369
• Microsoft Windows Server 2025 10.0.26100.2894
• Microsoft Windows Server 2025 (Server Core installation) 10.0.26100.2894

Not sure whether and how you are affected? Ask a question about this vulnerability

Metrics

Response and mitigation

1. 01

   Runbook step 1

   Immediate response (0-24 h)

   • Deploy the January 2025 security update (Patch Tuesday, 14 Jan 2025) to all affected builds. Minimum patched builds: Windows 10 21H2 10.0.19044.5371, Windows 10 22H2 10.0.19045.5371, Windows 11 22H2 10.0.22621.4751, Windows 11 22H3/23H2 10.0.22631.4751, Windows 11 24H2 and Windows Server 2025 10.0.26100.2894, Windows Server 2022 23H2 (Server Core) 10.0.25398.1369. Look up the per-build KB numbers in the Microsoft Security Update Guide entry for CVE-2025-21333.
   • Verify patch level from the endpoint, not just WSUS/Intune reporting: query OsBuildNumber plus the UBR value (HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\UBR) fleet-wide and compare against the builds above.
   • Prioritise hosts with Hyper-V components enabled: clients running Windows Sandbox, WSL2, Docker Desktop, the Hyper-V role, and multi-user systems (RDS/VDI, jump hosts, developer workstations). On these, any compromised user account becomes SYSTEM.
   • Where patching must wait, disable unneeded Hyper-V-based features — especially Windows Sandbox (Disable-WindowsOptionalFeature -Online -FeatureName Containers-DisposableClientVM) if operationally acceptable. Check impact on VBS/Credential Guard first.
   • Re-scope open incidents involving local foothold: on unpatched hosts with recent malware or unauthorised user access, assume possible SYSTEM escalation and rotate host-resident credentials (local admin, cached domain accounts, service accounts).
2. 02

   Runbook step 2

   Mitigation layers

   • Configuration/attack surface: Allow Hyper-V, Windows Sandbox and container features via GPO/Intune only where there is a business need; flag drift through compliance policies. The vulnerable component is the NT Kernel Integration VSP (vkrnlintvsp.sys) in the host kernel.
   • Endpoint hardening: Enforce application control (WDAC/AppLocker) to block unknown exploit binaries from user-writable paths (%TEMP%, %APPDATA%, Downloads). Local privilege escalation requires prior code execution as a user — cutting that step is the strongest lever.
   • IAM/least privilege: Restrict interactive and RDP logon rights on servers and VDI hosts to required groups. Deploy LAPS so a SYSTEM-level compromise does not translate into lateral movement via shared local admin passwords.
   • Credential protection: Enable LSA protection (RunAsPPL) and Credential Guard to make post-escalation credential theft harder; keep privileged domain accounts off standard clients (tiering model).
   • Network segmentation: No direct network signature is possible for a local exploit — instead restrict client/VDI egress to management segments (SMB 445, WinRM 5985/5986, RDP 3389) to contain follow-on activity.
3. 03

   Runbook step 3

   Detection rules

   • Sysmon EID 1 / Security 4688 — integrity jump: a process running as NT AUTHORITY\SYSTEM whose parent runs as a standard user at medium integrity and is not a known service/installer. KQL idea: DeviceProcessEvents | where AccountSid == "S-1-5-18" and InitiatingProcessAccountSid != "S-1-5-18" and InitiatingProcessFileName !in~ ("services.exe","msiexec.exe","svchost.exe").
   • Unexpected Windows Sandbox / Hyper-V container activity: WindowsSandbox.exe, WindowsSandboxClient.exe or vmcompute.exe on hosts where Sandbox is not normally used, especially when followed shortly by a new SYSTEM cmd.exe/powershell.exe in the same user session.
   • Kernel crashes as failed-attempt signal: System log Event ID 41 (Kernel-Power) and Event ID 1001 (BugCheck) or minidumps referencing vkrnlintvsp.sys — failed heap-overflow attempts often bluescreen the host. Treat repeated crashes on one machine as possible exploit testing.
   • EDR process ancestry: unsigned or freshly written binary in a user path → child with SYSTEM token → follow-on actions such as reg save HKLM\SAM, LSASS access (Sysmon EID 10, GrantedAccess 0x1010/0x1410), new service creation (Event 7045) or local admin group additions (Event 4732).
   • Sigma shape: logsource: windows/process_creation; selection: IntegrityLevel: System; filter_parent_system: ParentUser|contains: 'SYSTEM'; filter_installers: ParentImage|endswith: known_installers; condition: selection and not 1 of filter_* — baseline against legitimate UAC and software-deployment flows.

Detection rules

No NEOSEC detection rule is available for this vulnerability yet.

Classification under NIS2 and CRA

Rule-based classification from exploitation status and severity. It does not replace a case-by-case assessment.

NIS2

NIS2 is EU Directive (EU) 2022/2555 to raise the level of cybersecurity across the Union. It substantially broadens obligations compared with the first NIS directive: more sectors, mandatory risk management, staged reporting duties and personal accountability of senior management.

Read in glossary

Actively exploited: treat the vulnerability as a priority in vulnerability handling under Art. 21(2)(e) NIS2. If it is exploited in your environment, check the reporting obligation under Art. 23 (early warning within 24 hours).

CRA

The CRA is EU Regulation (EU) 2024/2847 setting horizontal cybersecurity requirements for „products with digital elements“ — from industrial controllers and software to connected consumer devices. For the first time manufacturers must ensure security across the entire product lifecycle, handle vulnerabilities and provide security updates.

Read in glossary

Since 11.09.2026, manufacturers of affected products with digital elements must report actively exploited vulnerabilities under Art. 14 CRA, with an early warning within 24 hours via ENISA's single reporting platform.

ISO/IEC 27001

ISO/IEC 27001 is the internationally leading standard for an information security management system (ISMS). It describes a risk-based, process-oriented framework to systematically plan, implement, review and improve information security.

Read in glossary

Control A.8.8, management of technical vulnerabilities: assess relevance to your systems, plan remediation and keep evidence.

Description

Windows Hyper-V NT Kernel Integration VSP Elevation of Privilege Vulnerability

Source: pwn.watch, NVD (NIST), Microsoft Security Update Guide, cvelistv5, CISA KEV Catalog, CVE.org (MITRE)

Vendors and products

• Microsoft Microsoft Windows 10 21H2
• Microsoft Microsoft Windows 10 22h2
• Microsoft Windows 10 Version 21h2
• Microsoft Windows 10 Version 22h2
• Microsoft Microsoft Windows 11 22H2
• Microsoft Microsoft Windows 11 23H2
• Microsoft Microsoft Windows 11 24H2
• Microsoft Windows 11 Version 22h2
• Microsoft Windows 11 Version 22h3
• Microsoft Windows 11 Version 23h2
• Microsoft Windows 11 Version 24h2
• Microsoft Windows Server 2022 23h2

Weakness classes (CWE)

• CWE-122Heap-based Buffer Overflow

  Variant

  A heap overflow condition is a buffer overflow, where the buffer that can be overwritten is allocated in the heap portion of memory, generally meaning that the buffer was allocated using a routine such as malloc().

  Entry at MITRE CWE-122

References & sources

• Microsoft Security Update GuideWindows Hyper-V NT Kernel Integration VSP Elevation of Privilege VulnerabilityVendor advisory, Patch, Patch, Vendor advisory
• cisa.govknown-exploited-vulnerabilities-catalog?field_cve=CVE-2025-21333government-resource, US government resource
• vicarius.iovsociety/posts/cve-2025-21333-elevated-privilege-exposure-in-wi…Mitigation, Third-party advisory
• vicarius.iovsociety/posts/cve-2025-21333-elevated-privilege-exposure-in-wi…Mitigation, Third-party advisory
• exploit-db.comexploits/52436Exploit, Third-party advisory, Vulnerability database
• pwn.watchpwn.watch: Microsoft Windows: 3 exploited vulnerabilities (CVE-2025-21333, CVE-2025-21334, CVE-2025-21335)pwn-watch
• Microsoft Security Update GuideMicrosoft advisory: Microsoft Windowspwn-watch
• Microsoft Security Update GuideMicrosoft advisory: Microsoft Windowspwn-watch
• Microsoft Security Update GuideMicrosoft advisory: Microsoft Windowspwn-watch
• NVD (NIST)NVD: CVE-2025-21333pwn-watch
• NVD (NIST)NVD: CVE-2025-21334pwn-watch
• NVD (NIST)NVD: CVE-2025-21335pwn-watch
• cisa.govCISA Known Exploited Vulnerabilities Catalogpwn-watch