This vulnerability (CVE-2025-21303) is a heap-based buffer overflow in the Windows Telephony Service on Windows 10 Version 1507 (build 10.0.10240.0). It enables remote code execution without requiring privileges but requires user interaction. The vulnerability has a CVSS 3.1 base score of 8.8, indicating high severity with network attack vector, low attack complexity, no privileges required, user interaction required, and impacts confidentiality, integrity, and availability. Microsoft has published an official fix for this vulnerability.

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary code remotely on an affected system, potentially leading to full system compromise. The vulnerability impacts confidentiality, integrity, and availability of the affected system. No known exploits in the wild have been reported at the time of publication.

An official fix is available from Microsoft. Users and administrators should apply the security update provided in the Microsoft advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-21303 to remediate this vulnerability.