CVE-2022-34713: Microsoft Windows Support Diagnostic Tool (MSDT) Remote Code Execution Vulnerability

CVE-2022-34713 is a remote code execution vulnerability in the Microsoft Windows Support Diagnostic Tool (MSDT). It arises when MSDT is invoked via the URL protocol from another application, allowing an attacker who can trigger that call path to run code in the context of the affected system. For IT and security teams, this matters because MSDT is a built-in Windows component present on many endpoints; successful abuse can lead to full compromise of the host without requiring the attacker to drop a separate executable first.

Public detail on exact mechanics and version ranges is limited to the vendor and CISA descriptions. Confirm all version, configuration, and patch specifics directly against the Microsoft advisory before acting.

How it works

The vulnerability is a remote code execution flaw in how Windows handles calls to MSDT through its registered URL protocol. A calling application can invoke MSDT using that protocol; when the invocation is crafted maliciously, the diagnostic tool processes the request in a way that permits arbitrary code execution.

An attacker typically needs a way to cause a legitimate or user-influenced application to make the MSDT URL-protocol call. Once that call occurs with attacker-controlled input, code runs with the privileges of the MSDT process or the calling context. The CWE class is not specified in the available record, so treat it as a classic unsafe handling of protocol-handler input leading to RCE. Do not assume particular file formats, lure documents, or exploitation chains beyond what the advisory states; verify those details with the vendor.

Am I affected? How to find it in your systems

MSDT ships as part of Microsoft Windows and is commonly present on workstations, laptops, and some servers. Inventory every Windows endpoint and server image in your environment. Query installed Windows build and update levels with your standard asset-management or endpoint-management tools (WSUS, ConfigMgr, Intune, or equivalent) and compare them against the fixed builds listed in the Microsoft security update guide for CVE-2022-34713.

Look for the presence of the MSDT binary and its URL-protocol registration. Review application inventories for software that may invoke diagnostic tools or custom protocol handlers. On the detection side, enable and collect process-creation and command-line logging (for example via Sysmon or Windows Event Forwarding) so you can later search for unexpected launches of msdt.exe or protocol-handler activity originating from office applications, browsers, or other user-facing processes. Signs of exploitation would appear as anomalous MSDT invocations with unusual arguments or parent processes; exact indicators must be taken from the vendor advisory or your threat-intelligence feed rather than assumed.

How to remediate

Apply the security updates Microsoft released for this vulnerability, following the vendor instructions referenced by CISA. Prioritize internet-facing and high-value endpoints first, then complete the rollout across the estate. After patching, verify the update is installed by checking the OS build or the specific KB listed in the advisory.

Once the patch is in place, harden the remaining attack surface for this class of issue: restrict or audit the use of custom protocol handlers, enforce least privilege so that user-mode processes cannot elevate through diagnostic tools, and keep application allow-listing policies current so only approved binaries can launch MSDT. Re-image or rebuild any systems that cannot be confirmed clean after exposure.

If you can't patch immediately

Until the vendor update can be deployed, reduce risk with compensating controls. Segment endpoints so that a compromised workstation has limited lateral reach. If your endpoint protection or host firewall can block or alert on msdt.exe launches from untrusted parents, enable that rule as a temporary virtual patch. Consider disabling the MSDT URL protocol handler via registry or Group Policy if your environment does not require the diagnostic tool for normal operations—test thoroughly first. Increase monitoring for process-creation events involving MSDT and forward those logs to your SIEM for rapid triage. These steps do not eliminate the vulnerability; they only buy time until the official update is applied.

If your data may have been exposed

Actively exploited remote-code-execution vulnerabilities frequently serve as the initial access vector for broader intrusions and data theft. If you have evidence of exploitation or cannot rule it out, treat the host as compromised: isolate it, collect forensic images, rotate credentials that were present on the system, and examine outbound traffic and authentication logs for follow-on activity. As a quick additional check, you can run a free exposure scan of your email addresses against known breach data sets to see whether associated credentials have already appeared in public dumps.