PatchSiren

PatchSiren cyber security CVE debrief

CVE-2025-21335 Microsoft CVE debrief

CVE-2025-21335 is a Microsoft Windows Hyper-V NT Kernel Integration VSP use-after-free vulnerability that CISA added to its Known Exploited Vulnerabilities (KEV) catalog on 2025-01-14. Because it is in KEV, defenders should treat it as a high-priority remediation item and follow Microsoft’s vendor guidance and CISA’s required-action timeline.

Vendor
Microsoft
Product
Windows
CVSS
HIGH 7.8
CISA KEV
Listed
Original CVE published
2025-01-14
Original CVE updated
2025-01-14
Advisory published
2025-01-14
Advisory updated
2025-01-14

Who should care

Organizations running Microsoft Windows systems that use Hyper-V or related virtualization features should prioritize this CVE, especially security teams responsible for patch management, endpoint hardening, and exposure reduction on servers and desktops.

Technical summary

The vulnerability is identified as a use-after-free in the Windows Hyper-V NT Kernel Integration VSP component. That class of flaw is a memory-safety issue that can lead to unstable or unintended behavior. The supplied corpus does not include exploit details or vendor impact notes, so the safest evidence-based posture is to treat the issue as actively exploited because CISA has listed it in KEV.

Defensive priority

High. CISA’s KEV inclusion indicates known exploitation and sets a remediation due date of 2025-02-04 in the supplied timeline, so this should be addressed ahead of routine maintenance work.

Recommended defensive actions

  • Review Microsoft’s security guidance for CVE-2025-21335 and apply the vendor-recommended update or mitigation as soon as practical.
  • Use CISA’s KEV catalog entry and due date to drive internal remediation tracking and escalation.
  • Inventory Windows systems that use Hyper-V or virtualization features to identify likely exposure.
  • If immediate remediation is not possible, apply the strongest available compensating controls and reduce exposure according to vendor guidance.
  • Verify patch deployment and confirm affected systems are no longer reporting the vulnerable state.

Evidence notes

This debrief is based on the supplied CISA KEV metadata and official resource links only. The source item identifies the vulnerability as 'Microsoft Windows Hyper-V NT Kernel Integration VSP Use-After-Free Vulnerability,' marks it as KEV, and gives dateAdded 2025-01-14 and dueDate 2025-02-04. No CVSS score, exploit chain, or impact detail was provided in the corpus, so those elements are intentionally not inferred.

Sources and references

Verified primary and authoritative sources

  • CVE-2025-21335 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2025-21335

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2025-21335 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2025-21335

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

  • CISA Known Exploited Vulnerabilities catalog

    Publisher, destination, and source semantics verified

    URL: https://www.cisa.gov/known-exploited-vulnerabilities-catalog

    Cybersecurity and Infrastructure Security Agency - Official CISA catalog of vulnerabilities known to be exploited in the wild.

Supplemental references

  • Source item URL

    Unverified legacy reference

    URL: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json

    cisa_kev

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.