CVE-2025-21334

CVE-2025-21334 is a use-after-free vulnerability (CWE-416) in the Microsoft Windows Hyper-V NT Kernel Integration VSP, the component that integrates the Hyper-V virtualization stack with the Windows NT kernel, and it is rated 7.8 (high) with a local, low-privilege attack vector. A local attacker who already has low-privileged access to an affected machine can trigger the flaw to reuse freed kernel memory and execute code with elevated, kernel-level privileges, gaining full control of the host as an additional step after an initial compromise. The flaw affects Windows 10 21H2 and 22H2, Windows 11 22H2, 23H2 and 24H2, Windows Server 2022 23H2, and Windows Server 2025, spanning much of Microsoft's currently supported client and server line. It was a zero-day: Microsoft patched it in the January 2025 Patch Tuesday release as one of three actively exploited flaws, and CISA added it to the Known Exploited Vulnerabilities catalog on January 14, 2025. Ransomware use is listed as unknown, and with a local attack vector the flaw is most plausibly used for post-compromise privilege escalation rather than initial access.

What to do: Apply Microsoft's January 2025 security updates (Patch Tuesday, January 14, 2025) to all affected Windows 10/11 clients and Windows Server hosts, prioritizing Hyper-V hosts and multi-user systems where local privilege escalation has the greatest impact. No workaround is listed, so any system still missing the patch should be treated as vulnerable; if patching is delayed, follow vendor mitigation guidance per the CISA KEV entry (added 2025-01-14) and inventory systems running Hyper-V or Windows virtualization features.