CVE-2025-21335

What is Hyper-V's NT Kernel Integration VSP?

The NT Kernel Integration Virtual Service Provider (VSP) is a Hyper-V host-side kernel component that processes VMBus messages from guest VMs. It runs at the highest kernel privilege level on the host. See CVE-2025-21333 for the full context on the Hyper-V VSP vulnerability cluster.

Overview

CVE-2025-21335 is the third use-after-free vulnerability (CWE-416) in the Windows Hyper-V NT Kernel Integration VSP disclosed as a zero-day in the January 2025 Patch Tuesday. It is a companion to CVE-2025-21333 (heap overflow) and CVE-2025-21334 (UAF) — all three allow a locally authenticated attacker within a guest VM to gain SYSTEM privileges on the Hyper-V host. The simultaneous disclosure of three Hyper-V VSP zero-days in a single Patch Tuesday is historically unusual.

Affected Versions

Technical Details

This second UAF in the VSP (alongside CVE-2025-21334) indicates that multiple distinct code paths within the NT Kernel Integration VSP's VMBus message processing are vulnerable to use-after-free conditions. The vulnerability is in a different function or code path than CVE-2025-21334, but the exploitation principle is the same: freed kernel objects on the host can be controlled by a guest VM through carefully timed VMBus operations and heap grooming, enabling host kernel code execution.

The three CVEs together (21333, 21334, 21335) represent multiple independent exploitation paths to host-level compromise from a guest VM — ensuring that even partial patching (applying only one or two of the fixes) leaves an exploit path open.

Exploitation Context

Confirmed zero-day exploitation before January 14, 2025. All three Hyper-V VSP CVEs were added to the CISA KEV catalog simultaneously on patch day.

Remediation

1. Apply the January 2025 cumulative update — patches all three Hyper-V VSP CVEs simultaneously. CISA deadline: February 4, 2025.
2. All three patches are required: CVE-2025-21333 (heap overflow), CVE-2025-21334 (UAF), and CVE-2025-21335 (this UAF) are all in the same cumulative update. Applying only some leaves attack paths open.
3. Restrict VM guest access — limit who can create and run VMs on Hyper-V hosts, particularly in shared environments.
4. Isolate high-risk workloads to dedicated host hardware separate from untrusted or multi-tenant VM workloads.