CVE-2022-30190
Microsoft Windows Support Diagnostic Tool (MSDT) Remote Code Execution Vulnerability
Description
CVE-2022-30190, widely known as "Follina," is a remote code execution vulnerability in the Microsoft Windows Support Diagnostic Tool (MSDT). The flaw is triggered when MSDT is called using the URL protocol from a calling application such as Microsoft Word, allowing an attacker to run arbitrary code with the privileges of the calling application. Exploitation requires only that a user opens a malicious document or previews it in Windows Explorer, making this Microsoft Windows vulnerability particularly dangerous in phishing scenarios. CISA has added CVE-2022-30190 to its Known Exploited Vulnerabilities catalog, and with an EPSS score of 93.6% (99th percentile) and confirmed use in ransomware campaigns, this vulnerability demands immediate remediation.
KEV Information
CVSS Score
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| microsoft | windows 10 1507 | < 10.0.10240.19325 |
| microsoft | windows 10 1607 | < 10.0.14393.5192 |
| microsoft | windows 10 1809 | < 10.0.17763.3046 |
| microsoft | windows 10 20h2 | < 10.0.19042.1766 |
| microsoft | windows 10 21h1 | < 10.0.19043.1766 |
| microsoft | windows 10 21h2 | < 10.0.19044.1766 |
| microsoft | windows 11 21h2 | < 10.0.22000.739 |
| microsoft | windows 7 | - |
| microsoft | windows 8.1 | - |
| microsoft | windows rt 8.1 | - |
| microsoft | windows server 2008 | r2 |
| microsoft | windows server 2012 | -; r2 |
| microsoft | windows server 2016 | < 10.0.14393.5192 |
| microsoft | windows server 2019 | < 10.0.17763.3046 |
| microsoft | windows server 2022 | < 10.0.20348.770 |
| microsoft | windows server 20h2 | < 10.0.19042.1766 |
Multiple CVSS Assessments
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
References
- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-30190(Vendor Advisory)
- http://packetstormsecurity.com/files/167438/Microsoft-Office-Word-MSDTJS-Code-Execution.html(Exploit, Third Party Advisory, VDB Entry)
- https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2022-30190(Patch, Vendor Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-30190(US Government Resource)
Weakness Type
CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer
While CVE-2022-30190 is primarily a protocol handler abuse vulnerability, its underlying exploitation mechanism involves improper handling of input passed through the MSDT URL protocol, which can lead to arbitrary code execution. The Windows MSDT does not properly validate input received through its protocol handler, allowing attackers to inject and execute malicious commands through specially crafted document payloads.
Learn more: CWE-119 — Improper Restriction of Operations within the Bounds of a Memory Buffer
Impact Analysis
CVE-2022-30190 is a critical remote code execution vulnerability that is remotely exploitable without requiring authentication or special privileges. The attack complexity is low — an attacker simply needs to send a specially crafted document to a victim, who only needs to open or preview it. No authentication is required and minimal user interaction (opening a document) triggers the exploit. Because the malicious code executes with the privileges of the calling application (typically Microsoft Word running under the user's context), an attacker can install programs, view or modify data, and create new accounts with full user rights. The EPSS score of 93.6% (99th percentile) indicates near-certain exploitation activity, and the confirmed use of CVE-2022-30190 in ransomware campaigns makes this vulnerability an existential threat to organizations that have not patched. The vulnerability affects all supported versions of Windows and is trivially exploitable through common email-based phishing vectors.
Exploit Maturity
CVE-2022-30190 has reached maximum exploit maturity, with widespread active exploitation confirmed across multiple threat actor groups. CISA has confirmed active exploitation in the wild and added it to the KEV catalog, with known ransomware usage explicitly documented. The EPSS score of 93.6% (99th percentile) reflects near-certain exploitation probability. Public proof-of-concept exploits are widely available, and the vulnerability has been weaponized in numerous phishing campaigns targeting organizations worldwide. The simplicity of exploitation — requiring only a malicious Office document — has made CVE-2022-30190 a favored tool for both cybercriminal groups and state-sponsored actors.
Remediation
- Apply the Microsoft security update immediately as required by CISA. Install the June 2022 cumulative security update for all affected Windows versions to address CVE-2022-30190.
- Disable the MSDT URL protocol as an interim mitigation if patching cannot be performed immediately: run
reg delete HKEY_CLASSES_ROOT\ms-msdt /ffrom an elevated command prompt, and back up the registry key first withreg export HKEY_CLASSES_ROOT\ms-msdt backup.reg. - Block Office applications from creating child processes using Attack Surface Reduction (ASR) rules in Microsoft Defender for Endpoint, which prevents the exploit chain from executing MSDT through Word or other Office applications.
- Deploy email gateway filtering to detect and quarantine documents containing suspicious MSDT URL protocol invocations, and educate users about the risk of opening unexpected document attachments.
- Monitor endpoint detection logs for MSDT process execution spawned by Office applications, which is an abnormal behavior pattern indicating attempted exploitation of CVE-2022-30190.
Technical Details
CVE-2022-30190 exploits the Microsoft Support Diagnostic Tool (MSDT) URL protocol handler (ms-msdt:/) to achieve remote code execution through specially crafted Office documents. When a victim opens a malicious document, the embedded OLE object or HTML template triggers a call to the ms-msdt protocol, passing attacker-controlled parameters to msdt.exe. The MSDT process then executes PowerShell or other commands specified in the crafted URL parameters with the privilege level of the calling Office application. Critically, this attack bypasses Microsoft Office macro security entirely because it does not rely on VBA macros — the exploit triggers through the URL protocol handler mechanism, which operates outside the macro execution policy. The attack can also be triggered through RTF files, which execute the payload during document preview in Windows Explorer without the document even being fully opened.
Frequently Asked Questions
Is CVE-2022-30190 being actively exploited?
Yes. CVE-2022-30190 (Follina) is under widespread active exploitation confirmed by CISA. It has been used in ransomware campaigns and by multiple threat actor groups in phishing attacks worldwide. The EPSS score of 93.6% (99th percentile) reflects near-certain exploitation activity. Immediate patching is critical.
What products are affected by CVE-2022-30190?
CVE-2022-30190 affects all supported versions of Microsoft Windows that include the MSDT component. The vulnerability is exploited through Microsoft Office applications (Word, Excel, Outlook) and can be triggered through RTF files in Windows Explorer. Any Windows system with MSDT and Office installed is potentially vulnerable.
How do I fix CVE-2022-30190?
Apply the June 2022 Microsoft cumulative security update to all affected Windows systems. As an interim mitigation, disable the MSDT URL protocol by deleting the ms-msdt registry key. Additionally, enable Attack Surface Reduction rules to block Office applications from spawning child processes.
How severe is CVE-2022-30190?
CVE-2022-30190 is a critical remote code execution vulnerability with an EPSS score of 93.6% indicating near-certain exploitation. It requires minimal user interaction (opening a document), bypasses macro security controls, and has been confirmed in ransomware campaigns. The combination of ease of exploitation, wide applicability, and active weaponization makes this one of the most severe Windows vulnerabilities in recent years.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.