CVE-2025-21273
Published: 14 January 2025
Summary
CVE-2025-21273 is a high-severity Heap-based Buffer Overflow (CWE-122) vulnerability in Microsoft Windows 10 1507. Its CVSS base score is 8.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 15.1% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-16 (Memory Protection) and SI-2 (Flaw Remediation).
Deeper analysis
The vulnerability CVE-2025-21273 is a remote code execution flaw in the Windows Telephony Service, carrying a CVSS 3.1 base score of 8.8 and classified under CWE-122. It affects the Telephony service component on Windows systems and was publicly disclosed on 14 January 2025.
An unauthenticated attacker can exploit the issue over the network with low attack complexity and no privileges, provided the victim performs a required user interaction. Successful exploitation grants full read, write, and execute capabilities on the target system, resulting in complete compromise of confidentiality, integrity, and availability.
The Microsoft Security Response Center advisory linked at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-21273 supplies official patch information and mitigation guidance. The associated EPSS score has remained flat at 0.0223 with no material increase since disclosure.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-2338
Vulnerability details
Windows Telephony Service Remote Code Execution Vulnerability
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
RCE vulnerability with network attack vector enables remote exploitation of the Telephony Service (T1190) and client-side execution via user interaction trigger (T1203).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly remediates the specific RCE flaw in Windows Telephony Service through timely application of vendor patches and updates.
Provides memory protections such as ASLR and stack canaries that mitigate exploitation of the stack-based buffer overflow (CWE-122) leading to RCE.
Enforces input validation to restrict malformed or oversized inputs to the Windows Telephony Service, reducing the risk of buffer overflow exploitation.