Remote Code Execution Vulnerability in Windows Telephony Service by Microsoft
CVE-2025-21303

8.8HIGH

Key Information:

Vendor: Microsoft
Status: Windows 10 Version 1809; Windows Server 2019; Windows Server 2019 (server Core Installation); Windows Server 2022
Vendor: CVE Published:; 14 January 2025

What is CVE-2025-21303?

This vulnerability in the Windows Telephony Service allows an attacker to execute arbitrary code on affected systems. Exploiting this issue could lead to unauthorized access and manipulation of system resources, posing significant risks to data integrity and security. Users are encouraged to follow vendor advisories for mitigation strategies and updates.

Affected Version(s)

Windows 10 Version 1507 32-bit Systems 10.0.10240.0 < 10.0.10240.20890

Windows 10 Version 1607 32-bit Systems 10.0.14393.0 < 10.0.14393.7699

Windows 10 Version 1809 32-bit Systems 10.0.17763.0 < 10.0.17763.6775

References

https://msrc.microsoft.com/update-guide/vulnerability/CVE...

vendor-advisory

CVSS V3.1

Score:

8.8

Severity:

HIGH

Confidentiality:

High

Integrity:

High

Availability:

High

Attack Vector:

Network

Attack Complexity:

Low

Privileges Required:

None

User Interaction:

Required

Scope:

Unchanged

Download the Critical Vulnerability Management Cheat Sheet

Timeline

Vulnerability published
Jan 14, 2025
Vulnerability Reserved
Dec 10, 2024

JSON