CVE-2025-21335

Microsoft Windows Hyper-V NT Kernel Integration VSP use-after-free vulnerability allows local attackers to gain SYSTEM privileges.

This local privilege escalation vulnerability enables attackers to escalate to SYSTEM on compromised Windows hosts, posing a severe risk to DIB organizations relying on Hyper-V for virtualization workloads. While not a zero-day or remote exploit, the local access combined with SYSTEM escalation makes it critical for patch management and access control enforcement.

Shame score — A local privilege escalation vulnerability that requires initial access but grants SYSTEM privileges, representing a significant risk if exploited within a compromised environment.