Windows Telephony Server Remote Code Execution Vulnerability

According to the CVSS metric, user interaction is required (UI:R) and privileges required are none (PR:N). What does that mean for this vulnerability?
An unauthorized attacker must wait for a user to initiate a connection.

According to the CVSS metric, the attack vector is network (AV:N) and the user interaction is required (UI:R). What is the target context of the remote code execution?
This attack requires an admin user on the client to connect to a malicious server, and that could allow the attacker to gain code execution on the client.

How could an attacker exploit this vulnerability?
An attacker could exploit the vulnerability by remotely managing another machine's Telephony server using the tapisnap.dll tool. This could result in a heap-based buffer out-of-bounds write due to malicious data returned by the Telephony server's RPC interface.

Security updates
10.0.17763.6414 — https://support.microsoft.com/help/5044277
10.0.20348.2762 — https://support.microsoft.com/help/5044281
10.0.22000.3260 — https://support.microsoft.com/help/5044280
10.0.19044.5011 — https://support.microsoft.com/help/5044273
10.0.22621.4317 — https://support.microsoft.com/help/5044285
10.0.25398.1189 — https://support.microsoft.com/help/5044288
10.0.26100.2033 — https://support.microsoft.com/help/5044284
10.0.10240.20796 — https://support.microsoft.com/help/5044286
10.0.14393.7428 — https://support.microsoft.com/help/5044293
6.0.6003.22918 — https://support.microsoft.com/help/5044320
6.0.6003.22918 — https://support.microsoft.com/help/5044306
6.1.7601.27366 — https://support.microsoft.com/help/5044356
6.1.7601.27366 — https://support.microsoft.com/help/5044321
6.2.9200.25118 — https://support.microsoft.com/help/5044342
6.3.9600.22221 — https://support.microsoft.com/help/5044343