CVE-2025-21370 Overview
CVE-2025-21370 is an elevation of privilege vulnerability in the Windows Virtualization-Based Security (VBS) Enclave component. Microsoft assigned it a CVSS 3.1 score of 8.8 and mapped it to [CWE-20] Improper Input Validation. The flaw affects Windows 11 versions 22H2, 23H2, and 24H2. A local, low-privileged attacker can leverage improper input validation in the VBS Enclave to escape the security boundary and gain elevated privileges. Successful exploitation results in a scope change, compromising resources beyond the initially vulnerable component. No public exploit code or in-the-wild activity has been reported at the time of publication.
Critical Impact
A local attacker with limited privileges can break the VBS Enclave trust boundary and obtain high-integrity code execution on affected Windows 11 systems.
Affected Products
- Microsoft Windows 11 version 22H2
- Microsoft Windows 11 version 23H2
- Microsoft Windows 11 version 24H2
Discovery Timeline
- 2025-01-14 - CVE-2025-21370 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-21370
Vulnerability Analysis
Virtualization-Based Security (VBS) Enclaves are isolated user-mode execution environments protected by the Windows hypervisor. Enclaves run at Virtual Trust Level 1 (VTL1) and are designed to safeguard secrets even from a compromised kernel at VTL0. This vulnerability breaks that isolation contract. Microsoft categorizes the issue under [CWE-20] Improper Input Validation, which indicates the enclave interface accepts attacker-controlled input without sufficient validation. An attacker who already holds low privileges on the host can craft inputs that cross the VTL boundary and influence trusted code paths.
The advisory reports a scope change (S:C) in the CVSS vector, confirming that exploitation impacts components beyond the vulnerable one. All three impact metrics are High, meaning the attacker gains full read, write, and availability control over affected resources after exploitation.
Root Cause
The root cause is improper validation of data passed to the VBS Enclave from a lower trust level. Enclave entry points must strictly validate untrusted parameters, because any control-flow deviation inside VTL1 undermines the entire isolation guarantee. When validation is incomplete, attacker-supplied input can drive the enclave into unintended states and elevate the calling process.
Attack Vector
Exploitation requires local access and low privileges on the target Windows 11 system. No user interaction is required. An attacker with an authenticated foothold, obtained through phishing, credential theft, or a prior remote flaw, invokes the vulnerable enclave interface with malformed input to trigger the privilege escalation. Because the attack vector is local and depends on unprivileged code execution, this vulnerability is best understood as a post-compromise escalation primitive rather than an initial-access flaw.
No verified proof-of-concept code has been published. See the Microsoft CVE-2025-21370 Advisory for the vendor's technical details.
Detection Methods for CVE-2025-21370
Indicators of Compromise
- Unexpected child processes spawned by processes that host or call VBS Enclave code, particularly those running at higher integrity than the parent.
- Anomalous loading of enclave DLLs (.enclave modules) by unsigned or non-Microsoft binaries.
- Local user accounts suddenly executing operations that require SYSTEM or administrator privileges without a preceding legitimate elevation event.
Detection Strategies
- Monitor Windows Event Log channels Microsoft-Windows-Hyper-V-Hypervisor and Microsoft-Windows-Kernel-Boot for VBS state transitions and enclave load failures.
- Correlate token elevation events (Event ID 4672, 4673, 4688) with the originating process lineage to identify unexplained privilege gains.
- Baseline the set of processes on managed endpoints that legitimately call CreateEnclave, LoadEnclaveImage, and CallEnclave APIs, then alert on deviations.
Monitoring Recommendations
- Ingest Windows security, Sysmon, and hypervisor telemetry into a centralized analytics platform to hunt across the fleet.
- Track Windows 11 build and patch level per host to identify systems still exposed to CVE-2025-21370 after the release of the vendor patch.
- Alert on suspicious local escalation chains, such as a standard user process followed by SYSTEM-level activity from the same session.
How to Mitigate CVE-2025-21370
Immediate Actions Required
- Apply the Microsoft security update referenced in the Microsoft CVE-2025-21370 Advisory to all Windows 11 22H2, 23H2, and 24H2 endpoints.
- Inventory endpoints and prioritize hosts that rely on VBS Enclaves for credential protection or third-party enclave workloads.
- Enforce least-privilege access to reduce the population of accounts that can execute local code on affected systems.
Patch Information
Microsoft addressed CVE-2025-21370 through the January 2025 security update cycle. Refer to the Microsoft CVE-2025-21370 Advisory for the KB numbers that match each Windows 11 build. Apply the update through Windows Update, WSUS, Microsoft Intune, or your enterprise patch management tool.
Workarounds
- No official workaround exists; the vendor patch is the only supported remediation.
- Restrict local logon rights and application execution on high-value endpoints until patching completes.
- Enable attack surface reduction rules and application control policies to limit which binaries can invoke enclave APIs on unpatched hosts.
# Verify installed Windows updates and current OS build
wmic qfe list brief /format:table
[System.Environment]::OSVersion.Version
Get-HotFix | Sort-Object -Property InstalledOn -Descending | Select-Object -First 20
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
