CVE-2025-21333

Microsoft · Published January 14, 2025

7.8

CVSS v3.1

HIGH

CISA KEV — Federal agencies must patch by deadline

Actively exploited in the wild

Patch availableGet patch

Description

Windows Hyper-V NT Kernel Integration VSP elevation-of-privilege vulnerability allowing local attackers to gain SYSTEM privileges. Exploited in the wild prior to patch availability.

Affected Products

Windows 11 22H2/23H2/24H2
Windows Server 2025

CVSS Vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Related Advisories

NEWSCRITICALCVE-2025-21298

January 2025 Patch Tuesday: 8 Zero-Days, 3 Critical — What to Prioritize

Microsoft's January 2025 Patch Tuesday addressed 159 vulnerabilities including 8 zero-days (3 exploited in the wild) and critical RCE flaws in Windows OLE, LDAP, and Hyper-V.

WHY IT MATTERS

Three actively exploited zero-days including a SYSTEM-level Hyper-V escalation — apply this month's patches before end of week.

MicrosoftWindowsPatch Management+1 more

Jan 14, 2025· 4 min read