Windows Hyper-V VSP Zero-Days: CVE-2025-21333/34/35

What to do

1. Check the OS build on every Windows 10, Windows 11 and Server 2025 host and compare with the fixed builds in the advisory.
2. Install the January 14, 2025 cumulative update or any later one on anything below those builds.
3. Prioritize hosts with Windows Sandbox or Defender Application Guard enabled, since the public exploit needs Windows Sandbox.
4. Disable Windows Sandbox where nobody uses it, to shrink the attack surface for this driver.
5. For Windows 10 machines past October 14, 2025 without ESU, plan the move to Windows 11; they receive no later fixes.

How to check if you are affected or compromised

• Check the build: Get-ItemProperty 'HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion' | Select CurrentBuild, UBR.
• Hunt EDR telemetry for WindowsSandboxClient.exe launched by unusual parent processes or by non-admin users who never use the sandbox.
• Look for unexpected SYSTEM shells or processes whose parent is a low-privileged user process, and for kernel crashes (bugchecks) on unpatched hosts.

What happened#

On January 14, 2025, Microsoft's Patch Tuesday fixed three elevation-of-privilege bugs in the Windows Hyper-V NT Kernel Integration Virtual Service Provider (VSP). CVE-2025-21333 is a heap-based buffer overflow. CVE-2025-21334 and CVE-2025-21335 are use-after-free bugs. A local user who exploits any of them gets SYSTEM. Microsoft scores each CVSS 3.1 7.8 and marked all three "Exploitation Detected". They were not publicly disclosed before the fix. CISA added all three to the KEV catalog the same day, with a February 4 federal deadline.

Microsoft's advisory FAQ clears up the name. Despite "Hyper-V", this is not a guest-to-host escape and does not sit in a traditional Hyper-V server. The VSP handles communication between the host and "container-type VMs, such as Windows Sandbox and Microsoft Defender Application Guard (MDAG)". The only credit is "Anonymous" on CVE-2025-21333. BleepingComputer noted that no information was released on how the flaws were used. That is still true: no attacker, campaign or victim has been named as of Oct 23, 2026.

A public exploit followed. Researcher Alessandro Iandoli published a proof of concept for CVE-2025-21333 in the driver vkrnlintvsp.sys, reported by IT-Connect on March 3, 2025. It overflows a paged-pool buffer to corrupt an I/O ring entry, gains kernel read/write and spawns a SYSTEM shell. The README says Windows Sandbox must be turned on, calls the exploit "not so reliable", and was tested on Windows 11 23H2.

Who is affected#

The CVE records list a narrower set than most Windows bugs: Windows 10 21H2 and 22H2, Windows 11 22H2, 23H2 and 24H2, Windows Server 2022 23H2 Edition and Windows Server 2025. Windows Server 2016, 2019 and the main Server 2022 release are not listed. Fixed builds are 19045.5371 for Windows 10 22H2, 22631.4751 for Windows 11 23H2 and 26100.2894 for Windows 11 24H2 and Server 2025. The January packages are KB5049981, KB5050021, KB5050009 and KB5049984. Records for CVE-2025-21334 and CVE-2025-21335 list the same products.

Do you really need to act?#

Probably not urgently. These are second-stage bugs: an attacker needs code running as a normal user first. As Tenable's Satnam Narang told Help Net Security, the harder part for attackers is gaining more privileged access "once they've gained initial system access". Rapid7 noted the component had not appeared in any Microsoft CVE since at least 2017. Cumulative updates include earlier fixes, so every Windows update since January 2025 closes all three.

The risk is the host that never got patched. A working public exploit lowers the bar for anyone holding a foothold. Windows 10 is a special case: Microsoft ended support for 22H2 on October 14, 2025. A machine without Extended Security Updates gets no later fixes at all.

What to do now#

1. Read the build on each host with Get-ItemProperty 'HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion' | Select CurrentBuild, UBR and compare it with the fixed builds above.
2. Install the January 2025 cumulative update or any later one wherever the build is lower.
3. Check which machines have the sandbox enabled with Get-WindowsOptionalFeature -Online -FeatureName Containers-DisposableClientVM. Patch those first, and disable the feature where nobody needs it.
4. Move Windows 10 machines without ESU to Windows 11.

How to tell if you were hit#

Microsoft has published no indicators. Hunt in EDR for WindowsSandboxClient.exe started by unusual parents or by users who never use the sandbox. The public exploit launches it. Look for SYSTEM processes whose parent runs as a standard user, and for kernel crashes on unpatched hosts, since the exploit can crash a machine. Treat any sign of local privilege escalation as a full compromise and look for the initial-access step that came before it.

Timeline#

• Jan 14, 2025 — Microsoft fixes all three bugs and marks them exploited. CISA adds them to KEV.
• Feb 4, 2025 — CISA's remediation deadline for federal agencies.
• Mar 3, 2025 — Press reports a public proof of concept for CVE-2025-21333.
• Oct 14, 2025 — Windows 10 22H2 reaches end of support.

Vulnerability records

• CVE-2025-21333 · KEV 2025-01-14 · Windows Hyper-V NT Kernel Integration VSP Elevation of Privilege Vulnerability
• CVE-2025-21334 · KEV 2025-01-14 · Windows Hyper-V NT Kernel Integration VSP Elevation of Privilege Vulnerability
• CVE-2025-21335 · KEV 2025-01-14 · Windows Hyper-V NT Kernel Integration VSP Elevation of Privilege Vulnerability

Sources

Original sources first: vendor and project advisories, CVE and government records, the discoverers’ write-ups. Every claim above links to one of these. See how the Security Desk works.

Original and primary sources

1. Microsoft MSRC — CVE-2025-21333 Windows Hyper-V NT Kernel Integration VSP Elevation of Privilege Vulnerability msrc.microsoft.com
2. Microsoft MSRC — January 2025 Security Updates (CVRF data with FAQ, KB numbers and exploitation status) api.msrc.microsoft.com
3. CVE record — CVE-2025-21333 cve.org
4. CVE record — CVE-2025-21334 cve.org
5. CVE record — CVE-2025-21335 cve.org
6. NVD — CVE-2025-21333 nvd.nist.gov
7. CISA — Known Exploited Vulnerabilities: CVE-2025-21333 cisa.gov
8. MrAle98 (Alessandro Iandoli) — CVE-2025-21333 proof of concept github.com
9. Microsoft Learn — Windows 10 reaching end of support learn.microsoft.com
10. Rapid7 — Patch Tuesday, January 2025 rapid7.com
11. IT-Connect — Hyper-V: un exploit PoC a été publié pour cette vulnérabilité exploitée comme zero-day it-connect.fr

Coverage and analysis

1. BleepingComputer — Microsoft January 2025 Patch Tuesday fixes 8 zero-days, 159 flaws bleepingcomputer.com
2. Help Net Security — Microsoft fixes actively exploited Windows Hyper-V zero-day flaws helpnetsecurity.com