CVE-2022-30190highunder attackransomware

CVE-2022-30190: high-severity vulnerability in Microsoft Windows 10 Version 1507

Microsoft Windows Support Diagnostic Tool (MSDT) Remote Code Execution Vulnerability

Published 01 Jun 2022 · Updated 06 Aug 2026

Follow this CVE + Monitor Windows Server + Monitor Windows

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

100Vexday Risk Score

Patch now. It under exploitation confirmed by CISA and has a working public exploit.

ssvc Actcvss 7.8epss 99%

from disclosure to weaponsame day

Published on NVDJun 1

1st PoCMay 30

metasploitMay 29

CISA KEV+13d

Action required by CISAfederal deadline: 2022-07-05

Apply updates per vendor instructions.

In short

Microsoft's Support Diagnostic Tool (MSDT) can be tricked into running malicious code when opened through a link in applications like Word. An attacker can exploit this to take control of your computer and steal data or install harmful software.

Technical detail

A remote code execution vulnerability in MSDT triggered via URL protocol handlers from applications such as Microsoft Word allows unauthenticated attackers to execute arbitrary code with the privileges of the calling process. Exploitation requires user interaction (opening a malicious link or document) but results in full code execution capability within the user's security context.

Summary generated and translated by AI from the official description.

The full analysis of this CVE is available in Portuguese →

A remote code execution vulnerability exists when MSDT is called using the URL protocol from a calling application such as Word. An attacker who successfully exploits this vulnerability can run arbitrary code with the privileges of the calling application. The attacker can then install programs, view, change, or delete data, or create new accounts in the context allowed by the user’s rights. Please see the MSRC Blog Entry for important information about steps you can take to protect your system from this vulnerability.

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C

Affected products

public PoCs found — 131

⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.

Related CVEs — Microsoft Windows 10 Version 1507

In the same product, most dangerous first.

CVE-2021-34527HIGHWindows Print Spooler Remote Code Execution VulnerabilityEPSS 99.8%KEV CVE-2023-36884HIGHWindows Search Remote Code Execution VulnerabilityEPSS 99.4%KEV CVE-2024-21412HIGHInternet Shortcut Files Security Feature Bypass VulnerabilityEPSS 99.4%KEV CVE-2021-40444HIGHMicrosoft MSHTML Remote Code Execution VulnerabilityEPSS 97.8%KEV CVE-2023-36025HIGHWindows SmartScreen Security Feature Bypass VulnerabilityEPSS 88.2%KEV CVE-2025-33053HIGHInternet Shortcut Files Remote Code Execution VulnerabilityEPSS 87.1%KEV

References

http://packetstormsecurity.com/files/167438/Microsoft-Office-Word-MSDTJS-Code-Execution.html https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-30190 https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2022-30190 https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-30190