CVE-2025-21333
Published: 14 January 2025
Summary
CVE-2025-21333 is a high-severity Heap-based Buffer Overflow (CWE-122) vulnerability in Microsoft Windows 10 21H2. Its CVSS base score is 7.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Privilege Escalation (T1068); ranked in the top 0.8% of CVEs by exploit likelihood; CISA has added it to the Known Exploited Vulnerabilities catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SI-2 (Flaw Remediation) and AC-6 (Least Privilege).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Directly mitigates CVE-2025-21333 by requiring timely patching of the Hyper-V NT Kernel Integration VSP elevation of privilege vulnerability.
Provides memory protections that mitigate heap-based buffer overflow exploits (CWE-122) underlying the privilege escalation in Hyper-V.
Enforces least privilege to restrict low-privileged local attackers from accessing or exploiting the Hyper-V VSP component.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
The CVE describes a local elevation of privilege vulnerability in the Windows Hyper-V NT Kernel Integration VSP component, directly matching T1068 as an exploit that allows a low-privileged attacker to gain high-impact elevated privileges.
NVD Description
Windows Hyper-V NT Kernel Integration VSP Elevation of Privilege Vulnerability
Deeper analysisAI
CVE-2025-21333 is an elevation of privilege vulnerability in the Windows Hyper-V NT Kernel Integration VSP component. It affects Windows Hyper-V, with a CVSS v3.1 base score of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), classified under CWE-122 and NVD-CWE-noinfo. The issue was published on January 14, 2025.
A local attacker with low privileges can exploit this vulnerability with low complexity and no user interaction required. Successful exploitation allows the attacker to gain high-impact confidentiality, integrity, and availability, potentially elevating privileges within the Hyper-V environment.
Microsoft's MSRC advisory provides an update guide for patching, while Vicarius shares Microsoft-provided detection and mitigation scripts. The vulnerability is listed in CISA's Known Exploited Vulnerabilities catalog.
A public exploit is available on Exploit-DB (ID 52436), indicating active real-world exploitation potential.
Details
- CWE(s)
- KEV Date Added
- 14 January 2025