CVE-2025-54092 Overview
CVE-2025-54092 is a race condition vulnerability in Windows Hyper-V that allows an authorized local attacker to elevate privileges. The flaw stems from concurrent execution using a shared resource with improper synchronization [CWE-362]. Microsoft published the advisory on September 9, 2025, covering supported Windows client and server releases that ship the Hyper-V role. Successful exploitation grants high impact to confidentiality, integrity, and availability on the affected host.
Critical Impact
An authenticated local attacker can win a race condition in Hyper-V to escalate privileges and gain full control of the host operating system.
Affected Products
- Microsoft Windows 10 (1809, 21H2, 22H2) x64
- Microsoft Windows 11 (22H2, 23H2, 24H2)
- Microsoft Windows Server 2019, 2022, 2022 23H2, and 2025
Discovery Timeline
- 2025-09-09 - CVE-2025-54092 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-54092
Vulnerability Analysis
The vulnerability resides in the Windows Hyper-V virtualization stack, which brokers privileged operations between guest partitions and the root partition. Hyper-V components share resources across concurrent threads, and this instance lacks adequate synchronization primitives. An authorized attacker executing code on the host can trigger the race window to corrupt shared state. Once the race is won, the attacker gains elevated privileges within the host operating system.
Because the attack vector is local and requires low privileges without user interaction, an attacker only needs an initial foothold on the host such as a low-privileged service account or interactive user session. The high scores across confidentiality, integrity, and availability reflect the trust boundary that Hyper-V crosses when handling virtualization primitives.
Root Cause
The root cause is a Concurrent Execution using Shared Resource with Improper Synchronization weakness [CWE-362]. Two or more threads access a shared Hyper-V resource without atomic guarantees, producing a Time-of-Check to Time-of-Use (TOCTOU) window. An attacker who repeatedly triggers the racing code path can force the kernel to operate on state that changed between validation and use.
Attack Vector
Exploitation requires local access with valid credentials on a system where the Hyper-V role or platform components are present. The attacker runs a controlled workload that repeatedly invokes the vulnerable Hyper-V code path while a second thread manipulates the shared resource. Winning the race yields a corrupted object reference or bypassed check, which the attacker converts into arbitrary kernel-mode operations. No verified public proof-of-concept code is available at the time of publication.
Detection Methods for CVE-2025-54092
Indicators of Compromise
- Unexpected privilege elevation events (Event ID 4672) associated with non-administrative accounts on Hyper-V hosts.
- Repeated crashes, bugchecks, or vmms.exe or vmcompute.exe service restarts preceding suspicious process creation.
- New services, scheduled tasks, or drivers created shortly after Hyper-V component instability.
Detection Strategies
- Monitor Windows kernel logs and Hyper-V-Worker/Hyper-V-VMMS operational channels for anomalous errors and repeated hypercall failures.
- Correlate high-frequency hypercall or IOCTL patterns from a single low-privileged process with subsequent token elevation.
- Baseline normal Hyper-V process behavior and alert on child processes spawned by vmwp.exe or vmcompute.exe outside expected parent-child chains.
Monitoring Recommendations
- Enable and forward Windows Security, System, and Hyper-V event channels to a centralized SIEM for correlation.
- Track patch state of Hyper-V hosts and alert when unpatched systems appear on the network.
- Deploy endpoint behavioral monitoring on all Hyper-V hosts to flag kernel exploitation patterns such as token swapping and process integrity level changes.
How to Mitigate CVE-2025-54092
Immediate Actions Required
- Apply the Microsoft September 2025 security updates to all Windows client and server systems that run Hyper-V.
- Inventory hosts with the Hyper-V role enabled and prioritize patching servers hosting sensitive workloads.
- Restrict local logon rights and administrative access on Hyper-V hosts to reduce the pool of accounts able to trigger the flaw.
- Enable tamper protection and kernel exploit protection features on all managed endpoints.
Patch Information
Microsoft released patches for all affected versions on September 9, 2025. Refer to the Microsoft CVE-2025-54092 Advisory for the specific KB articles for each supported Windows and Windows Server build. Apply the updates through Windows Update, WSUS, Microsoft Update Catalog, or your enterprise patch management platform.
Workarounds
- No official workaround exists; patching is the required remediation path.
- Where patching must be delayed, disable the Hyper-V role on hosts that do not require virtualization.
- Enforce the principle of least privilege and remove interactive logon rights from service accounts on Hyper-V hosts.
# Check Hyper-V role status and installed updates on a Windows host
Get-WindowsFeature -Name Hyper-V
Get-HotFix | Sort-Object -Property InstalledOn -Descending | Select-Object -First 20
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
