CVE-2025-21334

Microsoft Windows Hyper-V NT Kernel Integration VSP use-after-free vulnerability allows local attackers to gain SYSTEM privileges.

This local privilege escalation vulnerability enables attackers to escalate to SYSTEM on affected Windows Hyper-V environments, posing a severe risk to DIB organizations relying on virtualized infrastructure for sensitive data. While not a zero-day or remote exploit, the local access combined with SYSTEM privileges makes it a critical compliance failure for CMMC/NIST 800-171 vendors using unpatched Windows systems.

Shame score — A local privilege escalation vulnerability that requires physical or local access, making it less embarrassing than remote exploits but still critical for patch management compliance.