How do I check whether I am affected by CVE-2025-21335?

Check the installed Windows build against Microsoft's January 2025 security update for CVE-2025-21335 (unknown exact build numbers in sources) Run Get-WindowsFeature or check Hyper-V role presence on hosts (unknown exact command in sources)

What is the fix for CVE-2025-21335?

Install the Microsoft January 2025 Windows security update for CVE-2025-21335 If patching is not possible, follow Microsoft's mitigation guidance (unknown in sources)

Who is not affected by CVE-2025-21335?

Not affected if: fully-patched-systems, hyper-v-not-enabled.

Live › vulnerability › CVE-2025-21335

Go to dashboard

high7.8Exploited in the wildInfrastructure

Windows Hyper-V NT Kernel Integration VSP Elevation of Privilege Vulnerability

A use-after-free bug in the Windows Hyper-V NT Kernel Integration VSP lets a local user corrupt kernel memory. An attacker who already has a local account can gain SYSTEM privileges, and CISA reports it is being exploited in the wild.

Summary written from the sources below. Check the originals before acting.

CVSS 3.x

7.8

high

scored by [email protected]

known so far5 of 6

missing: primary source

First public: Jan 14, 2025 UTC
Last modified: Sep 24, 2026
Status: open
Known exploitation: Listed in CISA KEV
Public exploit: None on GitHub
EPSS: not scored

First seen by InfraStack 2026-10-23 19:11 UTC, 3h before NVD. All times on this page are UTC.

Why it is high, and not just CVSS

Likelihood → · Impact ↓

critical

high

medium

high

medium

low

medium

low

Exploited: Yes, on CISA KEV since Jan 14, 2025.
Needs login: Yes.
Needs a special setup: Yes.
Reachable from: local.
Worst case: Local user gains SYSTEM privileges, full control of the Windows host.
CVSS said: 7.8. The facts above say critical; exploitation in the wild moves it to high.

Known exploitation

CISA KEV

Know the next one before it finds you.

Add to Slack

Live › vulnerability › CVE-2025-21335

Go to dashboard

high7.8Exploited in the wildInfrastructure

Windows Hyper-V NT Kernel Integration VSP Elevation of Privilege Vulnerability

Summary written from the sources below. Check the originals before acting.

CVSS 3.x

7.8

high

scored by [email protected]

known so far5 of 6

missing: primary source

First public: Jan 14, 2025 UTC
Last modified: Sep 24, 2026
Status: open
Known exploitation: Listed in CISA KEV
Public exploit: None on GitHub
EPSS: not scored

First seen by InfraStack 2026-10-23 19:11 UTC, 3h before NVD. All times on this page are UTC.

Why it is high, and not just CVSS

Likelihood → · Impact ↓

critical

high

medium

high

medium

low

medium

low

Exploited: Yes, on CISA KEV since Jan 14, 2025.
Needs login: Yes.
Needs a special setup: Yes.
Reachable from: local.
Worst case: Local user gains SYSTEM privileges, full control of the Windows host.
CVSS said: 7.8. The facts above say critical; exploitation in the wild moves it to high.

Known exploitation

CISA KEV

Know the next one before it finds you.

Add to Slack

Product	Ecosystem	Affected	Fixed in
Microsoft Windows	vendor	–	–
microsoft windows 10 21h2	vendor	< 10.0.19044.5371	10.0.19044.5371
microsoft windows 10 22h2	vendor	< 10.0.19045.5371	10.0.19045.5371
microsoft windows 11 22h2	vendor	< 10.0.22621.4751	10.0.22621.4751
microsoft windows 11 23h2	vendor	< 10.0.22631.4751	10.0.22631.4751
microsoft windows 11 24h2	vendor	< 10.0.26100.2894	10.0.26100.2894
microsoft windows server 2022 23h2	vendor	< 10.0.25398.1369	10.0.25398.1369
microsoft windows server 2025	vendor	< 10.0.26100.2894	10.0.26100.2894

Windows Hyper-V NT Kernel Integration VSP Elevation of Privilege Vulnerability

Why it is high, and not just CVSS

Known exploitation

Know the next one before it finds you.

Windows Hyper-V NT Kernel Integration VSP Elevation of Privilege Vulnerability

Why it is high, and not just CVSS

Known exploitation

Know the next one before it finds you.

Who is affected

How to check

The fix

Who had it, and when

What the sources say, verbatim

Sources