Security readout for executives and security teams
Plain-English summary
CVE-2025-21333 is a Windows Hyper-V privilege escalation flaw. An attacker who already has low-privileged local access could gain high-impact control over confidentiality, integrity, and availability. Because CISA lists it in KEV, treat it as actively exploited and prioritize affected Windows client and server systems.
Executive priority
High priority. This is not described as remotely exploitable, but it affects core Windows platforms and is in CISA KEV. Patch affected systems promptly, especially Hyper-V hosts, virtualization infrastructure, and Windows servers with sensitive workloads.
Technical view
Microsoft describes this as a Hyper-V NT Kernel Integration VSP elevation-of-privilege vulnerability with CWE-122 and CVSS 7.8. The vector is local, low complexity, low privileges required, no user interaction, unchanged scope, and high CIA impact. Microsoft lists official remediation availability.
Likely exposure
Exposure is most relevant to affected Windows 10, Windows 11, Windows Server 2022 23H2 Server Core, and Windows Server 2025 systems listed by Microsoft. The bundle does not prove remote exposure; the CVSS vector indicates local access is required.
Exploitation context
Active exploitation is supported by the CISA KEV signal in the bundle. Exploit-DB is also cited, indicating public exploit interest, but this analysis does not rely on or describe exploit mechanics. Microsoft’s CVSS exploitability field in the bundle is E:U.
Researcher notes
Key constraints are local attack vector and low privileges required. The supplied data identifies CWE-122, official Microsoft remediation, and KEV status. The bundle does not include root-cause detail, vulnerable code paths, or reliable indicators of compromise.
Mitigation direction
- Apply Microsoft’s official update for CVE-2025-21333 through normal patch channels.
- Prioritize systems matching the affected Windows client and server versions.
- Track CISA KEV remediation expectations for operational urgency.
- Use third-party mitigation scripts only after internal review and change control.
- Monitor Microsoft guidance for supersedence or revised affected-version details.
Validation and detection
- Inventory Windows builds against the affected product and version list.
- Confirm the Microsoft security update for CVE-2025-21333 is installed.
- Run authenticated vulnerability scans after patch deployment.
- Review endpoint and server telemetry for suspicious local privilege escalation activity.
- Document exceptions where affected systems cannot be patched promptly.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-122: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupPrivilege behavior lookup
The CVE wording references privilege impact, so privilege escalation and authorization behavior review may help. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.
Open ATT&CK lookupCVE-2025-21333 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 7.8 (3.1)
- Known Exploited
- Yes
- Published
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CISA KEV status
SSVC decision data
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C1.85.9microsoftVulnerability scoring details
Base CVSS 3.1 score
7.8HighVector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- Added to KEVCISA-ADP
CISA Known Exploited Vulnerabilities metadata lists this CVE as known exploited.
- ADP timelineCISA-ADP
CVE-2025-21333 added to CISA KEV
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
- 2025-01-14T00:00:00.000Z: CVE-2025-21333 added to CISA KEV
Source materials
- CVE List V5 sourceCVE List V5
- Windows Hyper-V NT Kernel Integration VSP Elevation of Privilege VulnerabilityCVE reference, microsoft · vendor-advisory, patch
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-21333CVE reference, CISA-ADP · government-resource
- https://www.vicarius.io/vsociety/posts/cve-2025-21333-elevated-privilege-exposure-in-windows-hyper-v-by-microsoft-mitigation-scriptCVE reference, CVE
- https://www.vicarius.io/vsociety/posts/cve-2025-21333-elevated-privilege-exposure-in-windows-hyper-v-by-microsoft-detection-scriptCVE reference, CVE
- https://www.exploit-db.com/exploits/52436CVE reference, CVE
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Heap-based Buffer Overflow
Heap-based Buffer Overflow represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.