CVE-2022-30190: Microsoft Windows Support Diagnostic Tool (MSDT) Remote Code Execution Vulnerability

CVE-2022-30190 is a remote code execution vulnerability in the Microsoft Windows Support Diagnostic Tool (MSDT). When MSDT is invoked via its URL protocol from a calling application such as Word, an attacker can cause code to run with the privileges of that application. The flaw has been used in ransomware activity, so Windows environments that process untrusted documents or links need prompt attention.

Defenders should treat this as a high-priority item: confirm exposure against the vendor advisory, apply the supplied updates, and watch for signs of abuse until systems are fully remediated.

How it works

The weakness is classified as CWE-610 (Externally Controlled Reference to a Resource in Another Sphere). MSDT can be launched through a URL protocol handler from another application. An attacker who can supply a crafted reference—typically delivered through a document or similar file opened in a calling application—can cause MSDT to execute attacker-controlled actions under the privileges of that calling application rather than under a more restricted context.

Successful exploitation therefore yields code execution at the privilege level of the user or process that opened the malicious file. Exact invocation details and payload formats must be confirmed against the vendor advisory; do not rely on third-party write-ups alone for detection logic.

Am I affected? How to find it in your systems

The vulnerability affects Microsoft Windows systems that include the Support Diagnostic Tool and its URL protocol handler. MSDT is a built-in component on supported Windows releases, so inventory should focus on Windows endpoints and servers that run office productivity software or otherwise open untrusted files.

• Enumerate Windows hosts via your asset inventory, CMDB, or endpoint management tools and note build/version information.
• Confirm whether the MSDT URL protocol handler is registered and whether users routinely open documents from email, web downloads, or shared drives.
• Cross-check installed updates against the Microsoft advisory for CVE-2022-30190 to determine which systems still lack the fix.
• Review application control, script-block, and process-creation logs for unexpected launches of msdt.exe or child processes spawned from office applications; unusual parent-child relationships (for example, Word or similar launching MSDT) warrant investigation.
• Check EDR or SIEM telemetry for anomalous diagnostic-tool activity following document opens, especially on hosts that later exhibited ransomware indicators.

Specific affected builds and fixed versions are listed only in the vendor advisory—verify there before declaring a host clean.

How to remediate

Patch first. Apply the updates Microsoft released for CVE-2022-30190 according to the vendor instructions and CISA’s required action. Use your standard deployment ring (test, then production) and confirm installation via update compliance reports.

• After patching, validate that the MSDT-related fix is present on each host class you support.
• Where application allow-listing is in use, ensure policies still permit legitimate diagnostic use while blocking unexpected msdt.exe invocations from office suites.
• Reinforce least privilege so that even if a calling application is compromised, the resulting process token has minimal rights.
• Keep endpoint detection signatures and behavioral rules current so residual exploitation attempts are surfaced.

If you can't patch immediately

Until the vendor update can be deployed, reduce risk with compensating controls:

• Disable or unregister the MSDT URL protocol handler if your environment does not require it; test carefully so legitimate support workflows are not broken.
• Apply application control or attack-surface reduction rules that prevent office applications from launching msdt.exe or other unexpected children.
• Segment high-risk user populations and limit their ability to open untrusted documents from the internet or email.
• Use network or host-based virtual patching (WAF, IPS, or EDR block rules) tuned to known exploitation patterns for this class of protocol-handler abuse—confirm rule coverage against the vendor advisory.
• Increase monitoring and alerting on process ancestry involving MSDT and on subsequent suspicious network or file activity; retain logs for incident response.
• Remind users not to open unexpected attachments or links, and route high-risk file types through sandbox detonation where available.

If your data may have been exposed

Actively exploited vulnerabilities, including those with known ransomware use, frequently precede broader compromise and data theft. If you have indicators of exploitation or ransomware activity, follow your incident-response plan: isolate affected hosts, preserve evidence, and assess whether credentials or data left the environment. You can also run a free exposure scan of your email addresses against known breach data to see whether associated accounts appear in prior dumps and then prioritize password resets and monitoring accordingly.