CVE-2022-30190: Microsoft Windows MSDT URL Protocol Remote Code Execution

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 16 September 2026. Confidence: high.

critical priorityIt is in CISA KEV with known ransomware use, has a near-maximum EPSS score, and public exploit code exists, making exploitation highly likely and impactful.

What it is

CVE-2022-30190 is a remote code execution flaw in Microsoft Windows that triggers when the MSDT URL protocol is invoked from a calling application such as Word. Because MSDT runs with the privileges of the calling application, a crafted document can lead to code execution in the user's context. The flaw affects a wide range of Windows client and server versions and was exploited in the wild.

Impact

An attacker can run arbitrary code with the privileges of the calling application, allowing installation of programs, modification or deletion of data, and creation of new accounts within the user's rights. This can lead to full compromise of the user's session and, depending on privileges, the host.

Attack surface

Reached locally through a calling application that invokes the MSDT URL protocol, typically by opening a malicious document. The CVSS vector indicates no privileges required but user interaction is required, so the victim must open or interact with the crafted file.

Exploitation

CISA added this to the Known Exploited Vulnerabilities catalog on 2022-06-14 with a 2022-07-05 remediation due date and noted known ransomware campaign use. EPSS is 0.99234 (99.9th percentile), and a public exploit reference exists, indicating active and widespread exploitation.

What to do

• Apply the Microsoft security updates for all affected Windows versions as directed by the MSRC advisory.
• If patching cannot be done immediately, disable the MSDT URL protocol as described in Microsoft's guidance.
• Block or restrict execution of MSDT and related troubleshooting components where operationally feasible.
• Enforce attachment and document handling controls to reduce exposure to malicious files that invoke MSDT.
• Monitor for and remove malicious documents that attempt to call the MSDT URL protocol.

Detection

• Monitor process creation for msdt.exe spawned by Office applications such as WINWORD.EXE or EXCEL.EXE.
• Alert on command lines containing 'msdt' with '/id' or URL protocol handlers invoked from document readers.
• Review Office and Windows event logs for document opens followed by unusual child processes.
• Hunt for network connections or file writes originating from msdt.exe in user contexts.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.