CVE-2025-21333Exploit(microsoft / windows_10_21h2)

CRITICALCVSS 7.8 · HIGHCISA KEV

Exploitation ongoing with high activity in latest observed window (1 mentions)

Immediate actions

Patch microsoft windows_10_21h2 systems immediately
Assume compromise if assets are exposed
Hunt for exploitation attempts and persistence artifacts
Increase monitoring for publicly documented tradecraft

Recommended action window: Immediate (within 24h)

NVD description

Windows Hyper-V NT Kernel Integration VSP Elevation of Privilege Vulnerability

microsoft CVEs Back to dashboard

8.0/ 10 priority

Sources & remediation

Listed in the CISA Known Exploited Vulnerabilities catalog. Federal remediation due date: 2025-02-04. Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

Patch / fix

https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-21333

Exploit / PoC references

https://www.exploit-db.com/exploits/52436

Vendor / third-party advisories

Other references

https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-21333

Weakness type (CWE)

CWE-122

Priority

CRITICAL

Exploitation

ACTIVE

PoC

YES

Patch

AVAILABLE

Momentum

STABLE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

windows_10_21h2
windows_10_22h2
windows_11_22h2
windows_11_23h2

Threat summary

Active exploitation appears in 1 classified signals
Public PoC and exploit tooling are both present
Patch or workaround signal is available
4 mentions across 4 observed days

What's happening

Active exploitation reported across 1 signal
Exploit tool or code specified in 2 signals
PoC mentioned or linked in 2 signals
Patch or workaround mentioned in 1 signal
Technical details provided in 4 signals
Peaked 3d ago at 1 mentions (2026-02-04); latest day: 1
4 total mentions across 4 days

Affected systems

Vendors

microsoft

Products

windows_10_21h2windows_10_22h2windows_11_22h2windows_11_23h2windows_11_24h2windows_server_2022_23h2windows_server_2025

Deep dive

Activity timeline4 mentions / 4d

Signal classification3 categories

Exploit

250.0%

Patch

125.0%

Active Exploitation

125.0%

Referenced assets1 URL

By indicator

https://github.com/nu1lptr0/CVE-2025-21333

Classification over time

Date	Total	Labels

2026-02-04	1	Patch1
2026-05-05	1	Exploit1
2026-05-06	1	Exploit1
2026-07-10	1	Active Exploitation1

Full discourse4 posts

nu1lptr@_4bhishek158d
Exploit
CVE-2025-21333: poc https://github.com/nu1lptr0/CVE-2025-21333 (Integer truncation in vkrnlintvps.sys) Rewrote this exploit which is less sketchy as it doesn't open windows sandbox and little bit more stable. https://t.co/utkIobKFet
Post summary
The post shares a rewritten exploit (PoC code) for CVE-2025-21333 targeting an integer truncation issue in vkrnlintvps.sys, but provides no evidence of active attacks or patches.
13201358410.4K
458 followersView on X
DEFION | Ciberseguridad@defionsecurity92d
Active Exploitation
CVEs con explotación activa confirmada en junio: 🔴 CVE-2025-0282 · Ivanti VPN · RCE pre-auth (9.0) 🔴 CVE-2024-55591 · FortiOS · Auth bypass (9.8) 🟠 CVE-2025-21333 · Hyper-V · LPE (7.8) Tiempo medio de explotación desde publicación: <5 días. Nuestro equipo de ITE los tiene en el radar antes de que llegue el aviso.
Post summary
The message reports confirmed active exploitation of three CVEs in June, providing basic technical details but no PoC, patch, or tool information.
00010152
868 followersView on X
DarkRelay Security Labs@darkrelaylabs157d
Exploit
CVE-2025-21333 exploit evolution: ❌ IoRing spray (SubmitIoRing batch) → crash ✅ Pipe attrs → arbitrary read ✅ Refined IoRing spray → arbitrary write MDAG API for stable GUID (no sandbox) Thread priority matters. https://github.com/nu1lptr0/CVE-2025-21333 #Cybersecurity #Windows #Infosec
Post summary
The text describes the evolution of a functional exploit for CVE-2025-21333, detailing specific techniques and providing a link to code that implements the attack.
000101.1K
146 followersView on X
RagingCISO@CisoRaging77913248d
Patch
CVE-2025-21333/21334 + CVE-2026-20805: Hyper-V zero-days → SYSTEM access. DWM leaks memory to fuel exploit chains. 157 CVEs, 8 zero-days, one Patch Tuesday. CISA deadline expired today. Your critical servers run Hyper-V. Assume compromised if unpatched. Sweet dreams.
Post summary
The post highlights unpatched Hyper‑V servers at risk of zero‑day exploitation with SYSTEM access, noting a Patch Tuesday patch is available and urging immediate remediation.
00000140
4 followersView on X

CPE platform detail7 entries

Part:

Vendor:

Product:

Version:

Target SW:

Target HW:

7 of 7 entries

Part	Vendor	Product	Version	Target SW	Target HW
OS	microsoft	windows_10_21h2	-	-	x64
OS	microsoft	windows_10_22h2	-	-	x64
OS	microsoft	windows_11_22h2	-	-	-
OS	microsoft	windows_11_23h2	-	-	-
OS	microsoft	windows_11_24h2	-	-	-
OS	microsoft	windows_server_2022_23h2	-	-	x64
OS	microsoft	windows_server_2025	-	-	x64

Explore more

Back to dashboard microsoft CVEs windows_10_21h2 vulnerabilities

What researchers are saying

CVE-2025-21333

nu1lptr@_4bhishekExploit

The post shares a rewritten exploit (PoC code) for CVE-2025-21333 targeting an integer truncation issue in vkrnlintvps.sys, but provides no evidence of active attacks or patches.

DEFION | Ciberseguridad@defionsecurityActive Exploitation

The message reports confirmed active exploitation of three CVEs in June, providing basic technical details but no PoC, patch, or tool information.

DarkRelay Security Labs@darkrelaylabsExploit

The text describes the evolution of a functional exploit for CVE-2025-21333, detailing specific techniques and providing a link to code that implements the attack.

RagingCISO@CisoRaging77913Patch

The post highlights unpatched Hyper‑V servers at risk of zero‑day exploitation with SYSTEM access, noting a Patch Tuesday patch is available and urging immediate remediation.