PT-2025-1046 · Microsoft · Windows Telephony Service+1

Published 2025-01-14 · Updated 2025-01-24 · CVE-2025-21238

Positive Technologies (AI Summary)

CVSS v2.0

10

High

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

The Windows Telephony Service is affected by a remote code execution issue, allowing remote attackers to execute arbitrary code and gain control over the system. This issue can impact many Internet users. The affected software is the Windows Telephony Service, but the specific vulnerable versions are not specified. An exploit for this issue may be available, and more information can be found at https://t.co/JTGshHfTiB. #WindowsTelephonyService #RemoteCodeExecution #WindowsSecurity #TelephonyService #WindowsExploit #RemoteAttack #CodeExecution

Fix

RCE

Heap Based Buffer Overflow

Weakness Enumeration

CWE-122

Related Identifiers

BDU:2025-00276

CVE-2025-21238

Affected Products

Windows

Windows Telephony Service

References · 10

• https://osv.dev/vulnerability/CVE-2025-21238 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21238 · Security Note
• https://safe-surf.ru/specialists/bulletins-nkcki/716875 · Security Note
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-21238 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-21238 · Security Note
• https://bdu.fstec.ru/vul/2025-00276 · Security Note
• https://msrc.microsoft.com/update-guide/en-US/advisory/CVE-2025-21238 · Vendor Advisory
• https://t.me/cvenotify/108562 · Telegram Post
• https://twitter.com/windowsforum/status/1879262776092225578 · Twitter Post
• https://vuldb.com/?id.291692 · Note