Threat Brief: CVE-2022-30190 – MSDT Code Execution Vulnerability
Summary: On May 27, 2022, researchers disclosed malicious Word documents that abused the remote template feature and the ms-msdt Office URL protocol to run PowerShell inside Word, bypassing local macro policies; Microsoft assigned CVE-2022-30190 and issued protection guidance without a patch. The nao_sec team found a sample uploaded to VirusTotal from a Belarus IP, and John Hammond showed an RTF variant could bypass Protected View so the attack runs from the preview pane with no clicks.
What's compelling: A zero-click variant means a user merely previewing a file can trigger code execution at Word's privileges, and the final payload was never recovered in any sample seen, so defenders cannot yet know what it drops.
Read the original at Unit 42 Palo Alto Networks ↗
- Topics
- Vulnerabilities & Patching
- Mentions
- CVE-2022-30190
- Related
- CVE-2022-30190: Microsoft Windows Support Diagnostic Tool (MSDT) Remote Code Execution Vulnerability Known Exploited Vulnerabilities · Jun 14, 2022Microsoft Patch Tuesday, June 2022 Edition Cyber Risks ·