CVE-2025-21335 is a hyper-v NT kernel integration VSP use-after-free vulnerability in Microsoft Windows. CISA added it to the Known Exploited Vulnerabilities catalogue on 14 January 2025, which means attackers have used it in real attacks. Microsoft Windows Hyper-V NT Kernel Integration VSP contains a use-after-free vulnerability that allows a local attacker to gain SYSTEM privileges.
What a use-after-free means in a kernel integration component
A use-after-free in a kernel-mode integration layer means the code continues to access memory after it has been released. In a component such as Hyper-V NT kernel integration VSP, that kind of flaw can become a privileged local attack path because kernel execution bugs often sit close to the core trust boundary of the operating system.
These issues are dangerous not because they are exotic, but because the kernel is highly privileged and difficult to constrain once execution reaches it. A local attacker who can trigger the flaw may move from ordinary user privileges to SYSTEM, which is one of the most damaging outcomes on a Windows host.
Why this kind of vulnerability is high impact in Windows
Memory-safety failures in kernel components are frequently treated as priority issues because they can enable privilege escalation, code execution, or system instability. When the vulnerable code is part of a virtualisation or host integration path, the blast radius can extend beyond a single application process and affect the whole machine.
The practical concern is not just exploitation, but what exploitation buys the attacker next: higher privileges, persistence, and the ability to tamper with security tooling or credentials stored on the host. For background on software weakness classes, the CWE Top 25 Guide is a useful map of recurring bug patterns, including use-after-free and related memory safety failures.
How organisations assess exposure and remediation priority
Exposure assessment starts with asset inventory, because teams must know which Windows systems actually use the affected Hyper-V role or integration path. They also need to check internet exposure, remote access paths, and whether the vulnerable host is reachable from lower-trust environments or admin workstations.
For authoritative version and patch details, use the vendor advisory and the public CVE record rather than trying to infer applicability from the term alone. The official references are the CVE Program and the NIST National Vulnerability Database.
Detection, hardening, and post-exploitation review
Because this weakness is already known to be exploited in the wild, detection should look for signs that a local foothold was used to escalate privileges, tamper with drivers or services, or stage follow-on activity after patching. A patched system is not automatically clean if the attacker used the window before remediation.
Post-patch review should include process, service, and administrative activity around the vulnerable period, plus checks for suspicious persistence or credential theft. When a kernel bug is exploited successfully, identity impact can matter because SYSTEM access can expose cached secrets, session material, and highly privileged credentials on the host.
Risk and Threat Considerations
This vulnerability matters because a local attacker who can trigger kernel memory corruption may convert limited access into full host compromise. In practice, that turns a single workstation or server foothold into a platform for persistence, defence evasion, and lateral movement.
Failure mechanism: A use-after-free in a privileged kernel path can let attacker-controlled data be reused as a valid object or pointer, which can destabilise execution and redirect control in the kernel.
Impact: Successful exploitation can yield SYSTEM privileges, making it possible to disable protections, access sensitive local material, and expand compromise across the environment.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
CIS Controls v8, NIST SP 800-53 Rev 5 and NIST CSF 2.0 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| CIS Controls v8 | CIS-7 — Continuous Vulnerability Management | Kernel CVEs need prioritised identification, patching and exposure tracking. |
| Recommendation — Prioritise and remediate the vulnerable Windows hosts before attackers can escalate privileges. | ||
| NIST SP 800-53 Rev 5 | SI-2 — Flaw Remediation | This CVE is a software flaw requiring timely remediation and verification. |
| SI-16 — Memory Protection | Use-after-free is a memory corruption weakness in a privileged kernel component. | |
| Recommendation — Track the flaw through to verified remediation on all affected Windows systems. Apply memory-protection and hardening controls that reduce exploitability of kernel memory bugs. | ||
| NIST CSF 2.0 | ID.RA-01 — Asset Vulnerability Identification and Analysis | Exposure depends on knowing which assets run the vulnerable Hyper-V component. |
| PR.PS-01 — Configuration Management | Reducing exposure depends on controlled configuration and approved patching of Windows hosts. | |
| Recommendation — Identify exposed Windows assets and confirm where the vulnerable feature is present. Enforce secure configuration baselines and patch state across the affected fleet. | ||
Practitioner Guidance
Why practitioners should care: Treat this as more than a routine patch item, because kernel privilege escalation changes the trust assumptions of the entire host. Even short exposure windows can matter when the vulnerable component sits inside a core Windows integration path.
What to watch for: Prioritise systems that expose the vulnerable Windows feature set to untrusted users or to environments where local access is easier to obtain. If exploitation is suspected, review privileged logons, unexpected service creation, and evidence of post-escalation activity before and after remediation.
Related resources from NHI Mgmt Group
Deepen Your Knowledge
Free weekly newsletter
Subscribe to the NHI & AI Identity Journal
The latest on NHI and Agentic AI security – articles, research, breaches, news and events every week.
Bonus 33% off our NHI Course when you subscribe.
Reviewed and updated by the NHIMG editorial team on October 17, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org