CVE-2025-21286 is a heap-based buffer overflow vulnerability (CWE-122) in the Windows Telephony Service component of Microsoft Windows 10 Version 1507 (build 10.0.10240.0). The flaw allows an unauthenticated attacker to remotely execute code by exploiting the buffer overflow, potentially leading to full system compromise. The vulnerability has a CVSS 3.1 base score of 8.8, indicating high severity with network attack vector, low attack complexity, no privileges required, but user interaction needed. Microsoft has released an official fix to address this issue.

Successful exploitation of this vulnerability could allow remote code execution, resulting in complete compromise of the affected system's confidentiality, integrity, and availability. The attacker could execute arbitrary code in the context of the affected service, potentially gaining control over the system.

An official fix is available from Microsoft. Users and administrators should apply the security update provided in the Microsoft advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-21286 to remediate this vulnerability.