CVE-2025-21305
Published: 14 January 2025
Summary
CVE-2025-21305 is a high-severity Heap-based Buffer Overflow (CWE-122) vulnerability in Microsoft Windows 10 1507. Its CVSS base score is 8.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Client Execution (T1203); ranked in the top 17.6% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-2 (Flaw Remediation) and SI-16 (Memory Protection).
Deeper analysis
CVE-2025-21305 is a remote code execution vulnerability affecting the Windows Telephony Service. It carries a CVSS 3.1 base score of 8.8 and is associated with CWE-122. The flaw permits an unauthenticated network attacker to execute arbitrary code on affected Windows systems when certain conditions are met.
Exploitation requires user interaction and can result in full compromise of confidentiality, integrity, and availability on the target system. No privileges are needed beyond the ability to deliver a malicious interaction to a reachable Windows host running the Telephony Service.
The official Microsoft Security Response Center advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-21305 contains guidance on available patches and mitigation steps. The associated EPSS score remains low and unchanged at 0.0165 with no material increase observed after disclosure.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-2370
Vulnerability details
Windows Telephony Service Remote Code Execution Vulnerability
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
RCE vulnerability requires user interaction with malicious link or crafted file to trigger arbitrary code execution on client, directly enabling T1203 (Exploitation for Client Execution) and T1204 subtechniques (User Execution via malicious link/file).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly prevents exploitation of CVE-2025-21305 by requiring timely application of vendor patches to the vulnerable Windows Telephony Service.
Mitigates remote code execution from the heap-based buffer overflow (CWE-122) by enforcing memory protections such as DEP and ASLR to block unauthorized code execution.
Antimalware scanning detects and blocks malicious files or links crafted to trigger the Windows Telephony Service vulnerability.