CVE-2022-30190

Deeper analysis

A remote code execution vulnerability exists in the Microsoft Support Diagnostic Tool (MSDT) when it is invoked through its URL protocol handler by another application such as Microsoft Word. Successful exploitation allows an attacker to execute arbitrary code with the privileges of the calling process, enabling actions such as installing programs, viewing or modifying data, and creating accounts within the user's security context. The flaw carries a CVSS 3.1 score of 7.8 and is tracked under CVE-2022-30190.

An attacker can trigger the vulnerability by supplying a malicious document or link that causes the calling application to invoke MSDT via the ms-msdt: URL scheme. No special privileges are required beyond the ability to supply content that the victim opens or interacts with, after which code runs in the context of the targeted application.

Microsoft Security Response Center guidance and the associated security advisory direct administrators to apply the published mitigations, including disabling the MSDT URL protocol handler where feasible and following the specific steps outlined in the MSRC blog entry. The vulnerability is listed in CISA's Known Exploited Vulnerabilities catalog, confirming observed in-the-wild exploitation.

The associated EPSS score has reached a peak of 0.9746 with a current value of 0.9360, indicating sustained and substantial exploitation interest following disclosure.