CVE-2025-21333

CVE-2025-21333 is an elevation of privilege vulnerability in the Windows Hyper-V NT Kernel Integration VSP component. It affects Windows Hyper-V, with a CVSS v3.1 base score of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), classified under CWE-122 and NVD-CWE-noinfo. The issue was published on January 14, 2025.

A local attacker with low privileges can exploit this vulnerability with low complexity and no user interaction required. Successful exploitation allows the attacker to gain high-impact confidentiality, integrity, and availability, potentially elevating privileges within the Hyper-V environment.

Microsoft's MSRC advisory provides an update guide for patching, while Vicarius shares Microsoft-provided detection and mitigation scripts. The vulnerability is listed in CISA's Known Exploited Vulnerabilities catalog.

A public exploit is available on Exploit-DB (ID 52436), indicating active real-world exploitation potential.