CVE-2025-21273 is a heap-based buffer overflow vulnerability (CWE-122) in the Windows Telephony Service on Microsoft Windows 10 Version 1507 (build 10.0.10240.0). The flaw allows an unauthenticated attacker to remotely execute code by exploiting this vulnerability, potentially leading to full system compromise. The CVSS v3.1 base score is 8.8, indicating high severity with network attack vector, low attack complexity, no privileges required, user interaction required, and impacts to confidentiality, integrity, and availability. Microsoft has published an official fix for this vulnerability.

Successful exploitation of this vulnerability could allow remote code execution on affected systems, leading to complete compromise of confidentiality, integrity, and availability of the system. This could enable attackers to execute arbitrary code, install programs, view, change, or delete data, or create new accounts with full user rights.

An official fix is available from Microsoft. Users and administrators should apply the security update provided in the Microsoft advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-21273 to remediate this vulnerability.