CVE-2025-21334
Published: 14 January 2025
Summary
CVE-2025-21334 is a high-severity Use After Free (CWE-416) vulnerability in Microsoft Windows 11 22H2. Its CVSS base score is 7.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Privilege Escalation (T1068); ranked in the top 9.4% of CVEs by exploit likelihood; CISA has added it to the Known Exploited Vulnerabilities catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-16 (Memory Protection) and SI-2 (Flaw Remediation).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Directly remediates the Use After Free flaw in Windows Hyper-V by requiring timely application of vendor patches.
Implements memory safeguards such as DEP and ASLR to protect against exploitation of the Use After Free vulnerability in the Hyper-V kernel component.
Enforces least privilege to restrict low-privilege local attackers from gaining the initial access needed to exploit the elevation vulnerability.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Local use-after-free vulnerability in Hyper-V kernel component enabling direct privilege escalation from low-privileged local access.
NVD Description
Windows Hyper-V NT Kernel Integration VSP Elevation of Privilege Vulnerability
Deeper analysisAI
CVE-2025-21334 is an elevation of privilege vulnerability in the Windows Hyper-V NT Kernel Integration VSP component, stemming from a CWE-416 (Use After Free) flaw. It affects Windows Hyper-V systems and was published on 2025-01-14 with a CVSS v3.1 base score of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), indicating high impact potential from local access.
A local attacker with low privileges can exploit this vulnerability with low complexity and no user interaction required. Successful exploitation allows the attacker to elevate privileges, potentially gaining high confidentiality, integrity, and availability impacts on the affected system.
Microsoft's update guide at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-21334 provides details on patches and mitigation steps. The vulnerability is also listed in CISA's Known Exploited Vulnerabilities catalog at https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-21334, indicating real-world exploitation.
Details
- CWE(s)
- KEV Date Added
- 14 January 2025