CVE-2025-21237

CVE-2025-21237 is a Remote Code Execution vulnerability in the Windows Telephony Service, published on 2025-01-14. It carries a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) and is associated with CWE-122 (Heap-based Buffer Overflow) and NVD-CWE-noinfo. The flaw affects the Windows Telephony Service component, enabling attackers to execute arbitrary code on vulnerable systems.

An unauthenticated attacker can exploit this vulnerability remotely over the network with low attack complexity, though it requires user interaction to trigger. Successful exploitation grants high-impact remote code execution, compromising confidentiality, integrity, and availability of the affected system.

Microsoft's Security Response Center (MSRC) provides detailed guidance on mitigation and patching in its update guide at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-21237. Security practitioners should consult this advisory for applicable updates to affected Windows versions.