Microsoft Windows MSDT Remote Code Execution Vulnerability (Follina, CVE-2022-30190) Security Advisory
Executive & SecOps Summary
SECOPS ASSESSMENTWindows Operating Systems and Microsoft Office applications utilizing the Microsoft Support Diagnostics Tool (MSDT) protocol
Remote attackers can execute arbitrary code with the privileges of the calling application, potentially taking full control of the system
Apply the official Microsoft cumulative security updates immediately, or disable the MSDT URL protocol handler via registry modification
Affected Products & Version Scope
Remediation & Live Workaround Commands
PATCH & WORKAROUND1. Official Patch & Version Upgrade Commands
Apply the latest cumulative security updates provided by Microsoft. You can force Windows Update to search and install the required patches using the following PowerShell commands:
# Install Windows Update module and apply all pending security patches
Install-Module PSWindowsUpdate -Force -Confirm:$false
Get-WindowsUpdate -AcceptAll -Install -AutoReboot2. Temporary Workaround & Hardening Configuration
If patching cannot be deployed immediately, disable the MSDT URL protocol handler to block the attack vector. Run the following commands in an elevated Command Prompt (Admin):
# Backup the MSDT registry key
reg export HKEY_CLASSES_ROOT\ms-msdt ms-msdt-backup.reg
# Delete the MSDT registry key to disable the protocol handler
reg delete HKEY_CLASSES_ROOT\ms-msdt /f3. Log Audit & IoC Verification Commands
Use the following PowerShell script to inspect running processes and detect if MSDT was spawned by Microsoft Office applications, which is a strong Indicator of Compromise (IoC):
# Detect anomalous MSDT process spawning from Office applications
Get-CimInstance Win32_Process | Where-Object {
($_.ParentProcessId -ne $null) -and
(($_.Name -eq 'msdt.exe') -and
((Get-Process -Id $_.ParentProcessId).ProcessName -match 'winword|excel|powerpnt|outlook'))
} | Select-Object ProcessId, Name, ParentProcessId, CommandLine | Format-Table -AutoSizeBlock Kernel Privilege Escalation & Ransomware Payloads Before You Can Reboot
Protect unpatched Windows, Linux, and macOS workloads against in-memory exploitation and lateral movement with autonomous EDR.
Technical Root Cause & Exploitation Mechanics
1. Vulnerability Overview & Root Cause
This vulnerability (commonly known as 'Follina') is a remote code execution (RCE) vulnerability that exists when MSDT is called using the URL protocol from a calling application such as Microsoft Word. The root cause lies in the insufficient validation of input passed to the 'ms-msdt:' protocol handler. When a calling application processes a specially crafted document, it triggers the MSDT utility to execute arbitrary PowerShell commands without requiring administrative privileges or significant user interaction.
2. Exploitation Mechanics & Attack Scenario
An attacker exploits this vulnerability by crafting a malicious document (such as a .docx or .rtf file) that references an external HTML relationship template. When the victim opens the document (or previews it in Windows Explorer in the case of RTF), the application fetches the remote HTML file. This HTML file contains a payload utilizing the 'ms-msdt:' protocol scheme, padded with sufficient characters to bypass buffer limits, which forces the execution of local PowerShell commands via MSDT, bypassing Office Protected View and local execution policies.
3. Infrastructure & Business Impact
As a high-severity vulnerability listed in the CISA KEV catalog, CVE-2022-30190 has been actively exploited in the wild. Successful exploitation allows attackers to install unauthorized programs, view, alter, or delete sensitive data, or create new user accounts with high privileges. This poses a severe threat to enterprise endpoints, potentially serving as an initial access vector for ransomware deployment and lateral movement within corporate networks.
Official Vendor Advisories & References
A remote code execution vulnerability exists when MSDT is called using the URL protocol from a calling application such as Word. An attacker who successfully exploits this vulnerability can run arbitrary code with the privileges of the calling application. The attacker can then install programs, view, change, or delete data, or create new accounts in the context allowed by the user’s rights. Please see the MSRC Blog Entry for important information about steps you can take to protect your system from this vulnerability.
Frequently Asked SecOps Questions (CVE-2022-30190)
FAQQ1. How critical is CVE-2022-30190 and is it actively exploited in the wild?
CVE-2022-30190 is rated CVSS 7.8 (HIGH) with a 30-day EPSS exploitation probability of 99.2%. It is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, requiring immediate emergency remediation.
Q2. Which vendors and products are affected by CVE-2022-30190?
Primary impacted vendors include microsoft across windows, office, msdt. Scope summary: Windows 7, 8.1, 10, 11, Windows Server 2008, 2012, 2016, 2019, 2022 / Microsoft Office 2013, 2016, 2019, 2021, and Microsoft 365 Apps
Q3. What temporary mitigations or workarounds exist for CVE-2022-30190 before patching?
[Mitigation] Apply the official Microsoft cumulative security updates immediately, or disable the MSDT URL protocol handler via registry modification Follow the CLI remediation commands and interactive SecOps checklist on this page to restrict exposure prior to your maintenance window.
Generate an Internal Engineering Notice or CISO Report for CVE-2022-30190
Instantly format this advisory into an executive CISO summary or engineering patch ticket.
🔗 Related Advisories in Similar Stack (microsoft)
View Category →Windows ALPC Heap-Based Buffer Overflow Privilege Escalation Vulnerability (CVE-2026-85880) Security Advisory
[Affected Scope] Locally authenticated users across Microsoft Windows operating systems
Windows Update Stack Privilege Escalation Vulnerability via Link Following (CVE-2026-81963) Technical Advisory
[Affected Scope] Microsoft Windows operating systems utilizing the Windows Update Stack
Windows AFD.sys Use-After-Free Local Privilege Escalation Vulnerability (CVE-2026-68820) Security Advisory
[Affected Scope] Systems running Microsoft Windows operating systems utilizing the Ancillary Function Driver for WinSock (afd.sys)
Windows Shell Protection Mechanism Failure and Network Spoofing Vulnerability (CVE-2026-32202) Analysis and Mitigation Guide
[Affected Scope] Microsoft Windows operating systems utilizing the Windows Shell component
Subscribe to Daily Vulnerability Briefings & KEV Alerts
Concise morning briefings for SecOps, DevSecOps, and SRE teams covering newly exploited CVEs and mitigation priorities.