Microsoft Windows Support Diagnostic Tool (MSDT) Remote Code Execution Vulnerability (CVE-2022-34713, Dogwalk)
Executive & SecOps Summary
SECOPS ASSESSMENTMicrosoft Windows 7, 8.1, 10, 11 and Windows Server 2008, 2012, 2016, 2019, 2022 supporting the MSDT protocol
Successful exploitation allows remote attackers to execute arbitrary code on the target system when a user opens a specially crafted '.diagcab' file
Apply the official Microsoft security updates immediately, or disable the MSDT URL protocol handler as a temporary workaround
Affected Products & Version Scope
Remediation & Live Workaround Commands
PATCH & WORKAROUND1. Official Patch & Version Upgrade Commands
Apply the official cumulative security updates provided by Microsoft. You can verify and force the installation of the required updates using PowerShell.
# Check if the required security update (e.g., KB5016616) is installed
Get-HotFix -Id KB5016616, KB5016629 -ErrorAction SilentlyContinue
# Force Windows Update installation if missing
Install-Module PSWindowsUpdate -Force -SkipPublisherCheck
Get-WindowsUpdate -AcceptAll -Install -AutoReboot2. Temporary Workaround & Hardening Configuration
If patching cannot be applied immediately, disable the MSDT URL protocol handler to mitigate the attack vector.
# Backup and delete the MSDT URL protocol registry key (Run as Administrator)
reg export HKEY_CLASSES_ROOT\ms-msdt ms-msdt-backup.reg
reg delete HKEY_CLASSES_ROOT\ms-msdt /f3. Log Audit & IoC Verification Commands
Use the following PowerShell script to inspect Windows Security Logs for suspicious process creation events involving MSDT.
# Query Security Event Log (Event ID 4688) for suspicious msdt.exe execution
Get-WinEvent -FilterHashtable @{
LogName='Security';
Id=4688
} -ErrorAction SilentlyContinue | Where-Object {
$_.Message -like '*msdt.exe*'
} | Select-Object TimeCreated, Id, Message | Format-ListBlock Kernel Privilege Escalation & Ransomware Payloads Before You Can Reboot
Protect unpatched Windows, Linux, and macOS workloads against in-memory exploitation and lateral movement with autonomous EDR.
Technical Root Cause & Exploitation Mechanics
1. Vulnerability Overview & Root Cause
This vulnerability (CVE-2022-34713, commonly known as 'Dogwalk') is a path traversal and remote code execution vulnerability in the Microsoft Windows Support Diagnostic Tool (MSDT). The root cause lies in MSDT's failure to properly sanitize file paths when unpacking diagnostic cabinet (.diagcab) files, allowing directory traversal sequences to escape the intended temporary directory.
2. Exploitation Mechanics & Attack Scenario
An attacker exploits this vulnerability by crafting a malicious '.diagcab' file containing directory traversal sequences and an executable payload. The attacker then delivers this file via email phishing or malicious web downloads. When the victim opens the file, MSDT extracts the payload into a sensitive system directory, such as the user's Startup folder, instead of a secure temporary folder. Upon the next system reboot or user login, the dropped executable runs automatically, granting the attacker code execution under the context of the logged-in user.
3. Infrastructure & Business Impact
With a CVSS score of 7.8 (High) and active exploitation confirmed by its inclusion in the CISA KEV catalog, this vulnerability poses a severe threat to enterprise endpoints and servers. If exploited successfully, attackers can gain initial access, escalate privileges, move laterally across the network, deploy ransomware, or exfiltrate sensitive corporate data, leading to severe operational disruption.
Official Vendor Advisories & References
Microsoft Windows Support Diagnostic Tool (MSDT) Remote Code Execution Vulnerability
Frequently Asked SecOps Questions (CVE-2022-34713)
FAQQ1. How critical is CVE-2022-34713 and is it actively exploited in the wild?
CVE-2022-34713 is rated CVSS 7.8 (HIGH) with a 30-day EPSS exploitation probability of 67.8%. It is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, requiring immediate emergency remediation.
Q2. Which vendors and products are affected by CVE-2022-34713?
Primary impacted vendors include microsoft across windows, msdt. Scope summary: All supported versions of Microsoft Windows and Windows Server with the MSDT protocol enabled
Q3. What temporary mitigations or workarounds exist for CVE-2022-34713 before patching?
[Mitigation] Apply the official Microsoft security updates immediately, or disable the MSDT URL protocol handler as a temporary workaround Follow the CLI remediation commands and interactive SecOps checklist on this page to restrict exposure prior to your maintenance window.
Generate an Internal Engineering Notice or CISO Report for CVE-2022-34713
Instantly format this advisory into an executive CISO summary or engineering patch ticket.
🔗 Related Advisories in Similar Stack (microsoft)
View Category →Windows ALPC Heap-Based Buffer Overflow Privilege Escalation Vulnerability (CVE-2026-85880) Security Advisory
[Affected Scope] Locally authenticated users across Microsoft Windows operating systems
Windows Update Stack Privilege Escalation Vulnerability via Link Following (CVE-2026-81963) Technical Advisory
[Affected Scope] Microsoft Windows operating systems utilizing the Windows Update Stack
Windows AFD.sys Use-After-Free Local Privilege Escalation Vulnerability (CVE-2026-68820) Security Advisory
[Affected Scope] Systems running Microsoft Windows operating systems utilizing the Ancillary Function Driver for WinSock (afd.sys)
Windows Shell Protection Mechanism Failure and Network Spoofing Vulnerability (CVE-2026-32202) Analysis and Mitigation Guide
[Affected Scope] Microsoft Windows operating systems utilizing the Windows Shell component
Subscribe to Daily Vulnerability Briefings & KEV Alerts
Concise morning briefings for SecOps, DevSecOps, and SRE teams covering newly exploited CVEs and mitigation priorities.