CVE-2025-21325: Windows 10 21H2 Privilege Escalation Flaw

CVE-2025-21325 Overview

CVE-2025-21325 is an elevation of privilege vulnerability in Windows Secure Kernel Mode. The flaw affects Windows 10, Windows 11, and Windows Server 2025 systems. A local, authenticated attacker can exploit the vulnerability to gain higher privileges on the target system. Microsoft addressed the issue in its January 2025 security update cycle.

The vulnerability maps to CWE-732: Incorrect Permission Assignment for Critical Resource. Successful exploitation compromises confidentiality, integrity, and availability of the affected host. No public proof-of-concept is available, and the flaw is not listed in the CISA Known Exploited Vulnerabilities catalog.

Critical Impact
A local attacker with low privileges can escalate to elevated privileges within Secure Kernel Mode, bypassing Virtualization-Based Security (VBS) boundaries on affected Windows platforms.

Affected Products

Microsoft Windows 10 21H2 and 22H2
Microsoft Windows 11 22H2, 23H2, and 24H2
Microsoft Windows Server 2025

Discovery Timeline

2025-01-17 - CVE-2025-21325 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-21325

Vulnerability Analysis

Secure Kernel Mode (SKM) is the trusted execution environment enforced by the Windows hypervisor as part of Virtualization-Based Security. SKM isolates sensitive kernel components such as the LsaIso.exe process and Credential Guard secrets from the normal NT kernel. Weaknesses in this boundary undermine the security guarantees VBS is designed to provide.

CVE-2025-21325 stems from incorrect permission assignment on a resource that Secure Kernel Mode relies on. An attacker who already has local code execution on the host can interact with this resource to obtain privileges beyond what the initial account holds. The result is a break in the isolation model between normal-world and secure-world components.

Because the attack originates locally with low privileges and requires no user interaction, the vulnerability is well-suited to post-compromise stages of an intrusion. Threat actors typically chain such flaws with an initial access technique to move from a foothold to SYSTEM or to reach secrets protected by VBS.

Root Cause

The root cause is an CWE-732 permission misconfiguration on a critical resource used by Secure Kernel Mode. Microsoft has not published implementation details, and no proof-of-concept exists. Consult the Microsoft Security Update Guide for the authoritative patch metadata.

Attack Vector

Exploitation requires local access with low-level user privileges. The attacker executes code on the target host and manipulates the mis-permissioned resource to influence SKM behavior. Remote exploitation is not possible without a prior foothold. The vulnerability does not require any user interaction to succeed.

Detection Methods for CVE-2025-21325

Indicators of Compromise

Unexpected loading of unsigned or non-Microsoft drivers on hosts with Hypervisor-Protected Code Integrity (HVCI) enabled.
Creation of new processes running with SYSTEM or TrustedInstaller integrity from user-writable directories.
Modifications to Secure Kernel Mode related registry keys under HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard.

Detection Strategies

Monitor for local privilege escalation patterns such as token duplication, process handle theft, and abnormal parent-child process relationships involving services.exe or lsass.exe.
Baseline VBS and Credential Guard status across the fleet and alert on hosts where those protections silently disable after a reboot.
Correlate Sysmon Event ID 1 process creations with Event ID 4672 special privilege assignments to surface unexpected privilege elevation.

Monitoring Recommendations

Enable Microsoft Defender for Endpoint or an equivalent EDR with kernel-level telemetry and behavioral analytics.
Ingest Windows Security, System, and Microsoft-Windows-CodeIntegrity/Operational logs into a SIEM for centralized detection engineering.
Track patch compliance for KB articles referenced in the Microsoft Security Update Guide entry for CVE-2025-21325.

How to Mitigate CVE-2025-21325

Immediate Actions Required

Apply the January 2025 Microsoft security updates to all affected Windows 10, Windows 11, and Windows Server 2025 systems.
Prioritize patching on multi-user hosts, jump boxes, and systems where untrusted code may run.
Verify Virtualization-Based Security and HVCI remain enabled after patch installation using msinfo32 or Get-CimInstance -ClassName Win32_DeviceGuard.

Patch Information

Microsoft published the fix through the January 2025 Patch Tuesday release. Refer to the Microsoft Security Update Guide entry for CVE-2025-21325 for the exact KB identifiers matching each Windows build. Deploy the corresponding cumulative update through Windows Update, WSUS, or Microsoft Endpoint Configuration Manager.

Workarounds

No official workaround exists; patching is the only supported remediation.
Restrict local logon rights and remove unnecessary interactive users from affected systems to reduce the attack surface.
Enforce application allowlisting with Windows Defender Application Control (WDAC) to limit unauthorized local code execution.

bash

# Verify VBS and HVCI status on a Windows host
Get-CimInstance -ClassName Win32_DeviceGuard -Namespace root\Microsoft\Windows\DeviceGuard |
    Select-Object VirtualizationBasedSecurityStatus, SecurityServicesRunning

# Confirm the January 2025 cumulative update is installed
Get-HotFix | Where-Object { $_.InstalledOn -ge (Get-Date '2025-01-14') }