CVE-2022-30190: Microsoft Windows Support Diagnostic Tool (MSDT) Remote Code Execution Vulnerability

Severity: critical (CVSS 9.3 v2.0)
Exploited in the wild: yes — in CISA KEV since 2022-06-14
EPSS: 99.2% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2022-06-01 · updated 2026-08-06

Description

A remote code execution vulnerability exists when MSDT is called using the URL protocol from a calling application such as Word. An attacker who successfully exploits this vulnerability can run arbitrary code with the privileges of the calling application. The attacker can then install programs, view, change, or delete data, or create new accounts in the context allowed by the user’s rights. Please see the MSRC Blog Entry for important information about steps you can take to protect your system from this vulnerability.

Affected products

Microsoft Windows 10 Version 1507: before 10.0.10240.19325 — fixed in 10.0.10240.19325
Microsoft Windows 10 1607: before 10.0.14393.5192 — fixed in 10.0.14393.5192
Microsoft Windows 10: before 10.0.17763.3046 — fixed in 10.0.17763.3046
Microsoft Windows 10 20H2: before 10.0.19042.1766 — fixed in 10.0.19042.1766
Microsoft Windows 10 21H1: before 10.0.19043.1766 — fixed in 10.0.19043.1766
Microsoft Windows 10: before 10.0.19044.1766 — fixed in 10.0.19044.1766
Microsoft Windows 11 21H2: before 10.0.22000.739 — fixed in 10.0.22000.739
Microsoft Windows 7: all versions
Microsoft Windows 8.1: all versions
Microsoft Windows RT 8.1: all versions
Microsoft Windows Server 2008: r2-sp1
Microsoft Windows Server 2012: r2
Microsoft Windows Server 2016: before 10.0.14393.5192 — fixed in 10.0.14393.5192
Microsoft Windows Server 2019: before 10.0.17763.3046 — fixed in 10.0.17763.3046
Microsoft Windows Server 2022: before 10.0.20348.770 — fixed in 10.0.20348.770
Microsoft Windows Server 20H2: before 10.0.19042.1766 — fixed in 10.0.19042.1766
Microsoft Windows 10 Version 1507: from 10.0.10240.0 before 10.0.10240.19325 — fixed in 10.0.10240.19325
Microsoft Windows 10 1607: from 10.0.14393.0 before 10.0.14393.5192 — fixed in 10.0.14393.5192
Microsoft Windows 10: from 10.0.17763.0 before 10.0.17763.3046 — fixed in 10.0.17763.3046
Microsoft Windows 10 20H2: from 10.0.0 before 10.0.19042.1766 — fixed in 10.0.19042.1766
Microsoft Windows 10 21H1: from 10.0.0 before 10.0.19043.1766 — fixed in 10.0.19043.1766
Microsoft Windows 10: from 10.0.19043.0 before 10.0.19044.1766 — fixed in 10.0.19044.1766
Microsoft Windows 11 21H2: from 10.0.0 before 10.0.22000.739 — fixed in 10.0.22000.739
Microsoft Windows 7: from 6.1.0 before 6.1.7601.25984 — fixed in 6.1.7601.25984
Microsoft Windows 7 Service Pack 1: from 6.1.0 before 6.1.7601.25984 — fixed in 6.1.7601.25984
Microsoft Windows 8.1: from 6.3.0 before 6.3.9600.20402 — fixed in 6.3.9600.20402
Microsoft Windows Server 2008 R2 Service Pack 1: from 6.1.7601.0 before 6.1.7601.25984 — fixed in 6.1.7601.25984
Microsoft Windows Server 2012: from 6.2.9200.0 before 6.2.9200.23736 — fixed in 6.2.9200.23736
Microsoft Windows Server 2012 R2: from 6.3.9600.0 before 6.3.9600.20402 — fixed in 6.3.9600.20402
Microsoft Windows Server 2016: from 10.0.14393.0 before 10.0.14393.5192 — fixed in 10.0.14393.5192

How to fix

Upgrade to a fixed version: Microsoft Windows 10 Version 1507 10.0.10240.19325; Microsoft Windows 10 1607 10.0.14393.5192; Microsoft Windows 10 10.0.17763.3046; Microsoft Windows 10 20H2 10.0.19042.1766; Microsoft Windows 10 21H1 10.0.19043.1766; Microsoft Windows 10 10.0.19044.1766; Microsoft Windows 11 21H2 10.0.22000.739; Microsoft Windows Server 2016 10.0.14393.5192; Microsoft Windows Server 2019 10.0.17763.3046; Microsoft Windows Server 2022 10.0.20348.770; Microsoft Windows Server 20H2 10.0.19042.1766; Microsoft Windows 10 Version 1507 10.0.10240.19325. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2022-30190 or the next vulnerability affects your stack