CVE-2025-21333

Windows has a feature called Hyper-V that lets one computer run multiple virtual machines, like apartments inside one building. This flaw is like a weak wall between the building's maintenance closet and one of those apartments — someone with basic access to the building can break into the closet and take control of everything, including the building's master systems.

This matters to you if you run Windows 10, Windows 11, Windows Server 2022, or Windows Server 2025 — this includes virtually any Windows desktop, laptop, or server your business uses, whether or not Hyper-V virtualization is actively in use. An attacker needs some existing low-level access to the machine (such as a regular user account) to exploit this, but no special permissions beyond that are required.

Attackers are already exploiting this vulnerability in real-world attacks, which is why it's on CISA's official list of known exploited vulnerabilities with a government-mandated fix deadline that has already passed. Public proof-of-concept exploit code is also available, making this easy for more attackers to pick up. Treat this as urgent — patch immediately rather than scheduling it for a future maintenance window.

1. Inventory all Windows 10, Windows 11, Windows Server 2022, and Windows Server 2025 hosts and record their exact build numbers (winver, or systeminfo/registry OS build check at scale).
2. Compare against fixed builds: Windows 10 → 10.0.19044.5371 or 10.0.19045.5371; Windows 11 → 10.0.22621.4751, 10.0.22631.4751, or 10.0.26100.2894; Windows Server 2022 → 10.0.25398.1369; Windows Server 2025 → 10.0.26100.2894.
3. Deploy the relevant cumulative update via WSUS/Intune/SCCM or Windows Update; no special configuration changes are needed post-patch.
4. This is a local elevation-of-privilege bug (CWE-122, heap buffer overflow) in the Hyper-V VSP kernel integration component — it does not require network exposure, so isolate-by-network is not a viable workaround; prioritize patching over compensating controls.
5. If immediate patching isn't possible, review the vendor-linked detection/mitigation scripts (Vicarius) to assess exposure and apply interim hardening, but treat this strictly as a stopgap.
6. CISA KEV due date was 2025-02-04 — if still unpatched, this is significantly overdue; escalate internally.
7. Monitor for anomalous privilege escalation activity or unexpected SYSTEM-level process creation on endpoints, especially those exposed to untrusted local users (shared workstations, VDI, multi-tenant Hyper-V hosts).

CVSS 3.1 score 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) — local attack vector, low complexity, low privileges required, no user interaction, full impact on confidentiality/integrity/availability. Weakness is a heap-based buffer overflow (CWE-122) in the Hyper-V NT Kernel Integration VSP. Confirmed active exploitation per CISA KEV (added 2025-01-14, remediation due 2025-02-04); two public PoC exploits exist on GitHub, indicating mature exploit availability. EPSS trend is falling, consistent with exploitation having already peaked, but KEV status takes precedence over the predictive EPSS score for urgency assessment. Sustained press coverage reflects general vulnerability roundups rather than new exploitation developments.