CVE-2022-34713: Microsoft Windows Support Diagnostic Tool Remote Code Execution

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: medium.

high priorityIt is in CISA's KEV catalog with a very high EPSS score, indicating active exploitation, though the local vector and required user interaction limit mass exploitation.

What it is

CVE-2022-34713 is a remote code execution flaw in the Microsoft Windows Support Diagnostic Tool (MSDT). It affects a broad range of Windows client and server releases, and Microsoft classifies it as a high-severity issue. Because MSDT is a built-in Windows component, exploitation requires no additional software on the target.

Impact

An attacker who successfully exploits the flaw can execute arbitrary code in the context of the affected user. Given the CVSS impact ratings of high for confidentiality, integrity and availability, this can lead to full compromise of the user's session and data.

Attack surface

The CVSS vector is local (AV:L) with user interaction required (UI:R) and no privileges required (PR:N), meaning the attacker must get a victim to open or trigger a crafted file or link on the target system. No authentication is needed, but the victim must take an action.

Exploitation

The vulnerability is listed in CISA's Known Exploited Vulnerabilities catalog with a 2022-08-09 addition date, and EPSS gives it a 30-day probability of roughly 0.68 (99th percentile), indicating active exploitation is expected. CISA has not flagged it as used in known ransomware campaigns.

What to do

• Apply the Microsoft security updates referenced in the MSRC advisory for CVE-2022-34713 as the first action.
• Follow CISA KEV required action and remediate by the 2022-08-30 due date if not already done.
• Disable or restrict the MSDT URL protocol handler (ms-msdt) where business needs allow, to reduce the attack path.
• Block or warn on untrusted document and link types that can invoke MSDT, and enforce Mark-of-the-Web protections.
• Monitor for and restrict execution of msdt.exe spawned by document readers or browsers.

Detection

• Alert on msdt.exe processes spawned as a child of Office applications, browsers, or email clients.
• Monitor for ms-msdt: URI handler invocations and unusual command-line arguments passed to msdt.exe.
• Review endpoint logs for suspicious child processes of msdt.exe, such as scripting hosts or shells.
• Correlate file downloads or email attachments with subsequent msdt.exe execution on the same host.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.