CVE-2025-21239
Published: 14 January 2025
Summary
CVE-2025-21239 is a high-severity Heap-based Buffer Overflow (CWE-122) vulnerability in Microsoft Windows 10 1507. Its CVSS base score is 8.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Client Execution (T1203); ranked in the top 23.7% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-16 (Memory Protection).
Deeper analysis
CVE-2025-21239 is a remote code execution vulnerability in the Windows Telephony Service. The flaw is tracked under CWE-122 and carries a CVSS 3.1 base score of 8.8, reflecting network attack vector, low attack complexity, no required privileges, and required user interaction, with high impact on confidentiality, integrity, and availability.
An attacker can exploit the issue over the network by convincing a user to perform an action such as opening a malicious file or visiting a crafted link, resulting in arbitrary code execution within the context of the Telephony Service without further authentication.
Microsoft has published an advisory for CVE-2025-21239 that directs administrators to the corresponding security update for affected Windows versions. The EPSS score remains low, with a current value of 0.0091 and a peak of 0.0121.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-2306
Vulnerability details
Windows Telephony Service Remote Code Execution Vulnerability
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
RCE vulnerability in Windows service triggered via user interaction (malicious link/crafted input) directly maps to client-side exploitation for code execution.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly mitigates the RCE vulnerability by requiring timely remediation through patching of the Windows Telephony Service flaw as advised by Microsoft.
Prevents exploitation of crafted inputs targeting the Telephony Service by enforcing validation of all information inputs to block malformed data causing CWE-122 buffer overflows.
Mitigates remote code execution from heap-based buffer overflows in the Telephony Service via memory protections like DEP and ASLR.