A remote code execution vulnerability exists when MSDT is called using the URL protocol from a calling application such as Word. An attacker who successfully exploits this vulnerability can run arbitrary code with the privileges of the calling application. The attacker can then install programs, view, change, or delete data, or create new accounts in the context allowed by the user’s rights.
Please see the MSRC Blog Entry for important information about steps you can take to protect your system from this vulnerability.

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction Required

No CVSS v3.0

Access Vector Network

Access Complexity Medium

Authentication None

Confidentiality Impact Complete

Integrity Impact Complete

Availability Impact Complete

This CVE is in the KEV database since June 14, 2022.

The EPSS score is 0.93596.

Exploitation active

Automatable yes

Technical Impact total

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions
Microsoft Windows 10 Version 1809 affected
Version Status Constraints
10.0.17763.0 affected < 10.0.17763.3046
Microsoft Windows 10 Version 1809 affected
Version Status Constraints
10.0.0 affected < 10.0.17763.3046
Microsoft Windows Server 2019 affected
Version Status Constraints
10.0.17763.0 affected < 10.0.17763.3046
Microsoft Windows Server 2019 (Server Core installation) affected
Version Status Constraints
10.0.17763.0 affected < 10.0.17763.3046
Microsoft Windows 10 Version 21H1 affected
Version Status Constraints
10.0.0 affected < 10.0.19043.1766
Microsoft Windows Server 2022 affected
Version Status Constraints
10.0.20348.0 affected < 10.0.20348.770
Microsoft Windows 10 Version 20H2 affected
Version Status Constraints
10.0.0 affected < 10.0.19042.1766
Microsoft Windows Server version 20H2 affected
Version Status Constraints
10.0.0 affected < 10.0.19042.1766
Microsoft Windows 11 version 21H2 affected
Version Status Constraints
10.0.0 affected < 10.0.22000.739
Microsoft Windows 10 Version 21H2 affected
Version Status Constraints
10.0.19043.0 affected < 10.0.19044.1766
Microsoft Windows 10 Version 1507 affected
Version Status Constraints
10.0.10240.0 affected < 10.0.10240.19325
Microsoft Windows 10 Version 1607 affected
Version Status Constraints
10.0.14393.0 affected < 10.0.14393.5192
Microsoft Windows Server 2016 affected
Version Status Constraints
10.0.14393.0 affected < 10.0.14393.5192
Microsoft Windows Server 2016 (Server Core installation) affected
Version Status Constraints
10.0.14393.0 affected < 10.0.14393.5192
Microsoft Windows 7 affected
Version Status Constraints
6.1.0 affected < 6.1.7601.25984
Microsoft Windows 7 Service Pack 1 affected
Version Status Constraints
6.1.0 affected < 6.1.7601.25984
Microsoft Windows 8.1 affected
Version Status Constraints
6.3.0 affected < 6.3.9600.20402
Microsoft Windows Server 2008 R2 Service Pack 1 affected
Version Status Constraints
6.1.7601.0 affected < 6.1.7601.25984
Microsoft Windows Server 2008 R2 Service Pack 1 (Server Core installation) affected
Version Status Constraints
6.1.7601.0 affected < 6.1.7601.25984
Microsoft Windows Server 2012 affected
Version Status Constraints
6.2.9200.0 affected < 6.2.9200.23736
Microsoft Windows Server 2012 (Server Core installation) affected
Version Status Constraints
6.2.9200.0 affected < 6.2.9200.23736
Microsoft Windows Server 2012 R2 affected
Version Status Constraints
6.3.9600.0 affected < 6.3.9600.20402
Microsoft Windows Server 2012 R2 (Server Core installation) affected
Version Status Constraints
6.3.9600.0 affected < 6.3.9600.20402

Configuration 1 [-]

OR cpe:2.3:o:microsoft:windows_10_1507:*:*:*:*:*:*:*:*
cpe:2.3:o:microsoft:windows_10_1607:*:*:*:*:*:*:*:*
cpe:2.3:o:microsoft:windows_10_1809:*:*:*:*:*:*:*:*
cpe:2.3:o:microsoft:windows_10_20h2:*:*:*:*:*:*:*:*
cpe:2.3:o:microsoft:windows_10_21h1:*:*:*:*:*:*:*:*
cpe:2.3:o:microsoft:windows_10_21h2:*:*:*:*:*:*:*:*
cpe:2.3:o:microsoft:windows_11_21h2:*:*:*:*:*:*:*:*
cpe:2.3:o:microsoft:windows_7:-:sp1:*:*:*:*:*:*
cpe:2.3:o:microsoft:windows_8.1:-:*:*:*:*:*:*:*
cpe:2.3:o:microsoft:windows_rt_8.1:-:*:*:*:*:*:*:*
cpe:2.3:o:microsoft:windows_server_2008:r2:sp1:*:*:*:*:*:*
cpe:2.3:o:microsoft:windows_server_2012:-:*:*:*:*:*:*:*
cpe:2.3:o:microsoft:windows_server_2012:r2:*:*:*:*:*:*:*
cpe:2.3:o:microsoft:windows_server_2016:*:*:*:*:*:*:*:*
cpe:2.3:o:microsoft:windows_server_2019:*:*:*:*:*:*:*:*
cpe:2.3:o:microsoft:windows_server_2022:*:*:*:*:*:*:*:*
cpe:2.3:o:microsoft:windows_server_20h2:*:*:*:*:*:*:*:*

No data.

No data.

Project Subscriptions

Vendors Products
Microsoft Subscribe
Windows 10 1507 Subscribe
Windows 10 1607 Subscribe
Windows 10 1809 Subscribe
Windows 10 20h2 Subscribe
Windows 10 21h1 Subscribe
Windows 10 21h2 Subscribe
Windows 11 21h2 Subscribe
Windows 7 Subscribe
Windows 8.1 Subscribe
Windows Rt 8.1 Subscribe
Windows Server 2008 Subscribe
Windows Server 2012 Subscribe
Windows Server 2016 Subscribe
Windows Server 2019 Subscribe
Windows Server 2022 Subscribe
Windows Server 20h2 Subscribe
Advisories

No advisories yet.

Fixes

Solution

No solution given by the vendor.

Workaround

No workaround given by the vendor.

References
Link Providers
http://packetstormsecurity.com/files/167438/Microsoft-Office-Word-MSDTJS-Code-Execution.html cve-icon
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-30190 cve-icon cve-icon
https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2022-30190 cve-icon
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-30190 cve-icon cve-icon
History

Wed, 22 Oct 2025 00:30:00 +0000

Type Values Removed Values Added
References

Tue, 21 Oct 2025 20:30:00 +0000

Type Values Removed Values Added
References

Tue, 21 Oct 2025 19:30:00 +0000

Type Values Removed Values Added
References

Wed, 16 Jul 2025 13:45:00 +0000

Type Values Removed Values Added
Metrics epss

{'score': 0.93552}

 epss

{'score': 0.93429}

Fri, 04 Apr 2025 20:15:00 +0000

Type Values Removed Values Added
Weaknesses CWE-610 NVD-CWE-noinfo
CPEs cpe:2.3:o:microsoft:windows_server_2008:-:sp2:*:*:*:*:*:*

Tue, 04 Feb 2025 19:15:00 +0000

Type Values Removed Values Added
Metrics kev

{'dateAdded': '2022-06-14'}

ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'active', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Thu, 02 Jan 2025 19:15:00 +0000

Type Values Removed Values Added
Description A remote code execution vulnerability exists when MSDT is called using the URL protocol from a calling application such as Word. An attacker who successfully exploits this vulnerability can run arbitrary code with the privileges of the calling application. The attacker can then install programs, view, change, or delete data, or create new accounts in the context allowed by the user’s rights. Please see the MSRC Blog Entry for important information about steps you can take to protect your system from this vulnerability. A remote code execution vulnerability exists when MSDT is called using the URL protocol from a calling application such as Word. An attacker who successfully exploits this vulnerability can run arbitrary code with the privileges of the calling application. The attacker can then install programs, view, change, or delete data, or create new accounts in the context allowed by the user’s rights. Please see the MSRC Blog Entry for important information about steps you can take to protect your system from this vulnerability.
CPEs cpe:2.3:o:microsoft:windows_10_1507:10.0.10240.19325:*:*:*:*:*:x64:*
cpe:2.3:o:microsoft:windows_10_1507:10.0.10240.19325:*:*:*:*:*:x86:*
cpe:2.3:o:microsoft:windows_10_1607:10.0.14393.5192:*:*:*:*:*:x64:*
cpe:2.3:o:microsoft:windows_10_1607:10.0.14393.5192:*:*:*:*:*:x86:*
cpe:2.3:o:microsoft:windows_10_1809:10.0.17763.3046:*:*:*:*:*:arm64:*
cpe:2.3:o:microsoft:windows_10_1809:10.0.17763.3046:*:*:*:*:*:x64:*
cpe:2.3:o:microsoft:windows_10_1809:10.0.17763.3046:*:*:*:*:*:x86:*
cpe:2.3:o:microsoft:windows_10_20H2:10.0.19042.1766:*:*:*:*:*:arm64:*
cpe:2.3:o:microsoft:windows_10_20H2:10.0.19042.1766:*:*:*:*:*:x86:*
cpe:2.3:o:microsoft:windows_10_21H1:10.0.19043.1766:*:*:*:*:*:arm64:*
cpe:2.3:o:microsoft:windows_10_21H1:10.0.19043.1766:*:*:*:*:*:x64:*
cpe:2.3:o:microsoft:windows_10_21H1:10.0.19043.1766:*:*:*:*:*:x86:*
cpe:2.3:o:microsoft:windows_10_21H2:10.0.19044.1766:*:*:*:*:*:arm64:*
cpe:2.3:o:microsoft:windows_10_21H2:10.0.19044.1766:*:*:*:*:*:x64:*
cpe:2.3:o:microsoft:windows_10_21H2:10.0.19044.1766:*:*:*:*:*:x86:*
cpe:2.3:o:microsoft:windows_11_21H2:10.0.22000.739:*:*:*:*:*:arm64:*
cpe:2.3:o:microsoft:windows_11_21H2:10.0.22000.739:*:*:*:*:*:x64:*
cpe:2.3:o:microsoft:windows_7:6.1.7601.25984:sp1:*:*:*:*:x64:*
cpe:2.3:o:microsoft:windows_7:6.1.7601.25984:sp1:*:*:*:*:x86:*
cpe:2.3:o:microsoft:windows_8.1:6.3.9600.20402:*:*:*:*:*:x64:*
cpe:2.3:o:microsoft:windows_8.1:6.3.9600.20402:*:*:*:*:*:x86:*
cpe:2.3:o:microsoft:windows_rt_8.1:6.3.9600.20402:*:*:*:*:*:*:*
cpe:2.3:o:microsoft:windows_server_2008_R2:6.1.7601.25984:*:*:*:*:*:x64:*
cpe:2.3:o:microsoft:windows_server_2012:6.2.9200.23736:*:*:*:*:*:x64:*
cpe:2.3:o:microsoft:windows_server_2012_R2:6.3.9600.20402:*:*:*:*:*:x64:*
cpe:2.3:o:microsoft:windows_server_2016:10.0.14393.5192:*:*:*:*:*:*:*
cpe:2.3:o:microsoft:windows_server_2019:10.0.17763.3046:*:*:*:*:*:*:*
cpe:2.3:o:microsoft:windows_server_2022:10.0.20348.770:*:*:*:*:*:*:*
cpe:2.3:o:microsoft:windows_server_20H2:10.0.19042.1766:*:*:*:*:*:*:*
Vendors & Products Microsoft windows 10 20h2
Microsoft windows 10 21h1
Microsoft windows 10 21h2
Microsoft windows 11 21h2
Microsoft windows Server 2008 R2
Microsoft windows Server 2012 R2
Microsoft windows Server 20h2
References

Projects

Sign in to view the affected projects.

cve-icon MITRE

Status: PUBLISHED

Assigner: microsoft

Published:

Updated: 2025-10-21T23:15:38.954Z

Reserved: 2022-05-03T00:00:00.000Z

Link: CVE-2022-30190

cve-icon Vulnrichment

Updated: 2024-08-03T06:40:47.824Z

cve-icon NVD

Status : Analyzed

Published: 2022-06-01T20:15:07.983

Modified: 2025-10-30T19:19:41.540

Link: CVE-2022-30190

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

No data.

Weaknesses