CVE-2022-30190

Exploited in the Wild ✓ Confirmed 0-Day ★ Google Project Zero

Triaged: March 3, 2026 21 articles

VulnLookup ↗ NVD ↗ MITRE ↗ Advisory ↗ P0 Sheet ↗ CISA KEV ↗

EPSS Score

Source: FIRST.org · 2026-05-24

93.53%

probability

This CVE has a 93.53% probability of being exploited in the next 30 days.

0% Top 99.8th percentile of all CVEs 100%

CVSS score unavailable

Neither CIRCL nor NVD returned a CVSS score for this CVE. View on VulnerabilityLookup ↗

Description

Project Zero

Microsoft Windows Support Diagnostic Tool (MSDT) Remote Code Execution Vulnerability

Google Project Zero

Patched

June 14, 2022

Reported by

crazyman with Shadow Chaser Group

Root Cause Analysis

???

Exploits & PoC

komomon/CVE-2022-30190-follina-Office-MSDT-Fixed

CVE-2022-30190-follina.py-修改版，可以自定义word模板，方便实战中钓鱼使用。

393

JMousqueton/PoC-CVE-2022-30190

POC CVE-2022-30190 : CVE 0-day MS Offic RCE aka msdt follina

158

Malwareman007/Deathnote

Proof of Concept of CVE-2022-30190

Hrishikesh7665/Follina_Exploiter_CLI

Exploit Microsoft Zero-Day Vulnerability Follina (CVE-2022-30190)

MalwareTech/FollinaExtractor

Extract payload URLs from Follina (CVE-2022-30190) docx and rtf files

ErrorNoInternet/FollinaScanner

A tool written in Go that scans files & directories for the Follina exploit (CVE-2022-30190)

Noxtal/follina

All about CVE-2022-30190, aka follina, that is a RCE vulnerability that affects Microsoft Support Diagnostic Tools (MSDT) on Office apps such as Word.

7 repos — triés par ⭐ Rechercher sur GitHub ↗

Windows MSDT zero-day now exploited by Chinese APT hackers

BleepingComputer May 31, 2022

Microsoft Releases Workarounds for Office Vulnerability Under Active Exploitation

TheHackerNews

Microsoft patches actively exploited Follina Windows zero-day

BleepingComputer Jun 14, 2022

Windows MSDT zero-day vulnerability gets free unofficial patch

BleepingComputer Jun 01, 2022

Microsoft Issues Patches for 121 Flaws, Including Zero-Day Under Active Attack

TheHackerNews

Researchers Warn of Unpatched "DogWalk" Microsoft Windows Vulnerability

TheHackerNews

Defense Lessons From the Black Basta Ransomware Playbook

Qualys Feb 25, 2025

June 2022 Patch Tuesday | Microsoft Releases 55 Vulnerabilities With 3 Critical; Adobe Releases 6 Advisories, 46 Vulnerabilities With 40 Critical.

Qualys Jun 14, 2022

From Ransomware to Cyber Espionage: 55 Zero-Day Vulnerabilities Weaponized in 2022

TheHackerNews

Inside the customer environment: Where threat actors, vulnerabilities, and exposed assets intersect

Tenable-Research May 27, 2026

Windows zero-day exploited in US local govt phishing attacks

BleepingComputer Jun 06, 2022

Chinese Hackers Begin Exploiting Latest Microsoft Office Zero-Day Vulnerability

TheHackerNews

Mitigating the Risk of Zero-Day Vulnerabilities by using Compensating Controls

Qualys Aug 23, 2022

Security Advisory 2022-039

CERT-EU May 30, 2022

State-Backed Hackers Exploit Microsoft 'Follina' Bug to Target Entities in Europe and U.S

TheHackerNews

Security Advisory 2022-042

CERT-EU Jun 15, 2022

Microsoft June 2022 Patch Tuesday fixes 1 zero-day, 55 flaws

BleepingComputer Jun 14, 2022

New Windows Search zero-day added to Microsoft protocol nightmare

BleepingComputer Jun 01, 2022

Microsoft shares mitigation for Office zero-day exploited in attacks

BleepingComputer May 31, 2022

Hackers Exploiting Follina Bug to Deploy Rozena Backdoor

TheHackerNews

Signal Intelligence

Confidenceⓘ

92%

EPSS 93.53%

Mentions 21

Last Seen May 27, 2026

CNA Information

Analyst Note

CVE-2022-30190 (Follina) is a well-documented remote code execution vulnerability affecting Microsoft Office through the MSDT protocol handler, with high CVSS score (7.8) and confirmation by Google Project Zero. Multiple security advisories from CERT-EU and widespread coverage substantiate the vulnerability's authenticity and severity in real-world exploitation scenarios.