CVE-2025-21305

Summary

CVE-2025-21305 is a newly disclosed remote code execution vulnerability affecting the Windows Telephony Service. Successful exploitation allows an attacker to execute arbitrary code on the targeted system. This vulnerability could potentially be exploited through specially crafted SIP (Session Initiation Protocol) messages, posing a significant threat to organizations that rely on VoIP (Voice over IP) communications. Mitigation includes applying the available Microsoft Security Update or disabling the affected component. Organizations are urged to prioritize patching to prevent potential attacks.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.