CVE-2025-21371
Published: 11 February 2025
Summary
CVE-2025-21371 is a high-severity Heap-based Buffer Overflow (CWE-122) vulnerability in Microsoft Windows Server 2008. Its CVSS base score is 8.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Client Execution (T1203); ranked at the 45.9th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 RA-5 (Vulnerability Monitoring and Scanning) and SI-2 (Flaw Remediation).
Deeper analysis
CVE-2025-21371 is a Remote Code Execution vulnerability in the Windows Telephony Service. Published on 2025-02-11T18:15:35.540, it carries a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) and is associated with CWE-122 and NVD-CWE-noinfo.
A remote unauthenticated attacker can exploit this vulnerability over the network with low complexity by tricking a user into some interaction, such as clicking a malicious link or opening a file. Successful exploitation enables arbitrary code execution in the context of the service, resulting in high impacts to confidentiality, integrity, and availability, potentially leading to full system compromise.
Microsoft's update guide at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-21371 provides details on patching. Vicarius offers a detection script at https://www.vicarius.io/vsociety/posts/windows-telephony-service-remote-code-execution-vulnerability-detection-script and a mitigation script at https://www.vicarius.io/vsociety/posts/windows-telephony-service-remote-code-execution-vulnerability-mitigation-script.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-2434
Vulnerability details
Windows Telephony Service Remote Code Execution Vulnerability
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
The vulnerability is a remote code execution flaw in Windows Telephony Service requiring user interaction (malicious link or file) over the network, directly mapping to Exploitation for Client Execution.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly mandates timely remediation of known flaws like CVE-2025-21371 through patching the Windows Telephony Service vulnerability.
Requires vulnerability scanning to identify unpatched systems affected by this specific RCE in Windows Telephony Service.
Provides memory protections such as ASLR and DEP to mitigate exploitation of the heap-based buffer overflow (CWE-122) in this vulnerability.