CVE-2025-21406

Summary

CVE-2025-21406 is a newly disclosed vulnerability affecting the Windows Telephony Service. This issue permits an attacker to execute arbitrary code remotely, potentially leading to a compromise of the affected system. Successful exploitation relies on sending specially crafted RTP packets to a targeted Windows server. The vulnerability poses a significant risk to organizations that rely on the Windows Telephony Service for voice communications, and it is recommended that affected systems be patched as soon as possible. Microsoft has released a security update to address this vulnerability, and it is strongly advised that all Windows servers be updated to mitigate the risk.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.