CVE-2022-30190

ENISA EUVD: EUVD-2022-35396 ↗
Exploited in the Wild ✓ Confirmed 0-Day ★ Google Project Zero
Triaged: March 3, 2026 20 articles Published: 2022-06-01

EPSS Score

Source: FIRST.org · 2026-05-23
93.53%
probability
This CVE has a 93.53% probability of being exploited in the next 30 days.
0% Top 99.8th percentile of all CVEs 100%

CVSS v3.1

Source: VulnerabilityLookup (CIRCL)
7.8
HIGH
Attack Vector
Local
Attack Complexity
Low
Privileges Required
None
User Interaction
Required
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High
Temporal
Exploit Code Maturity
Proof-of-Concept
Remediation Level
Official Fix
Report Confidence
Confirmed
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C

CVSS v2 (legacy)

9.3
HIGH
Access Vector
Network
Access Complexity
Medium
Authentication
None
Confidentiality
Complete
Integrity
Complete
Availability
Complete
AV:N/AC:M/Au:N/C:C/I:C/A:C

Description

NVD
A remote code execution vulnerability exists when MSDT is called using the URL protocol from a calling application such as Word. An attacker who successfully exploits this vulnerability can run arbitrary code with the privileges of the calling application. The attacker can then install programs, view, change, or delete data, or create new accounts in the context allowed by the user’s rights. Please see the MSRC Blog Entry for important information about steps you can take to protect your system from this vulnerability.

Affected Products

Microsoft
Windows 10 Version 1809
10.0.17763.0
Microsoft
Windows 10 Version 1809
10.0.0
Microsoft
Windows Server 2019
10.0.17763.0
Microsoft
Windows Server 2019 (Server Core installation)
10.0.17763.0
Microsoft
Windows 10 Version 21H1
10.0.0

Google Project Zero

Patched
June 14, 2022
Reported by
crazyman with Shadow Chaser Group
Root Cause Analysis
???

Exploits & PoC

komomon/CVE-2022-30190-follina-Office-MSDT-Fixed

CVE-2022-30190-follina.py-修改版,可以自定义word模板,方便实战中钓鱼使用。

392 2023-04-13
JMousqueton/PoC-CVE-2022-30190

POC CVE-2022-30190 : CVE 0-day MS Offic RCE aka msdt follina

157 2022-06-05
onecloudemoji/CVE-2022-30190

CVE-2022-30190 Follina POC

105 2022-05-31
doocop/CVE-2022-30190

Microsoft Office Word Rce 复现(CVE-2022-30190)

60 2022-05-31
archanchoudhury/MSDT_CVE-2022-30190

This Repository Talks about the Follina MSDT from Defender Perspective

38 2022-06-02
Malwareman007/Deathnote

Proof of Concept of CVE-2022-30190

38 2022-10-06
Hrishikesh7665/Follina_Exploiter_CLI

Exploit Microsoft Zero-Day Vulnerability Follina (CVE-2022-30190)

33 2022-06-16
MalwareTech/FollinaExtractor

Extract payload URLs from Follina (CVE-2022-30190) docx and rtf files

31 2022-06-15
ErrorNoInternet/FollinaScanner

A tool written in Go that scans files & directories for the Follina exploit (CVE-2022-30190)

23 2022-09-13
Noxtal/follina

All about CVE-2022-30190, aka follina, that is a RCE vulnerability that affects Microsoft Support Diagnostic Tools (MSDT) on Office apps such as Word.

21 2022-08-06
0xflagplz/MS-MSDT-Office-RCE-Follina

CVE-2022-30190 | MS-MSDT Follina One Click

20 2022-06-03
dwisiswant0/gollina

Follina MS-MSDT 0-day MS Office RCE (CVE-2022-30190) PoC in Go

17 2022-06-01
aminetitrofine/CVE-2022-30190

Follina (CVE-2022-30190) is a Microsoft Office zero-day vulnerability that has recently been discovered. It’s a high-severity vulnerability that hacke

12 2023-05-14
drgreenthumb93/CVE-2022-30190-follina

Just another PoC for the new MSDT-Exploit

8 2023-04-20
Gra3s/CVE-2022-30190_EXP_PowerPoint

This is exploit of CVE-2022-30190 on PowerPoint.

8 2023-03-23
abbarhissarh/FollinaXploit

A Command Line based python tool for exploit Zero-Day vulnerability in MSDT (Microsoft Support Diagnostic Tool) also know as 'Follina' CVE-2022-30190.

8 2022-11-19
sudoaza/CVE-2022-30190

MS-MSDT Follina CVE-2022-30190 PoC document generator

7 2022-06-01
PaddlingCode/cve-2022-30190

CVE-2022-30190 remediation via removal of ms-msdt from Windows registry

6 2022-05-31
DerZiad/CVE-2022-30190

This project demonstrates a proof-of-concept exploit for CVE-2022-30190, also known as "Follina"—a critical remote code execution vulnerability affect

6 2025-09-13
AbdulRKB/Follina

Remote Access Shell for Windows (based on cve-2022-30190)

5 2024-02-09
sentinelblue/CVE-2022-30190

Microsoft Sentinel analytic rule and hunting queries in ASIM for activity of MSDT and CVE-2022-30190.

4 2022-06-08
Cosmo121/Follina-Remediation

Removes the ability for MSDT to run, in response to CVE-2022-30190 (Follina)

4 2022-10-08
dsibilio/follina-spring

Server to host/activate Follina payloads & generator of malicious Word documents exploiting the MS-MSDT protocol. (CVE-2022-30190)

4 2022-06-14
rouben/CVE-2022-30190-NSIS

An NSIS script that helps deploy and roll back the mitigation registry patch for CVE-2022-30190 as recommended by Microsoft

3 2022-06-01
EkamSinghWalia/Follina-MSDT-Vulnerability-CVE-2022-30190-

Detection and Remediation of the Follina MSDT Vulnerability (CVE-2022-30190)

3 2022-07-22
gamingwithevets/msdt-disable

MSDT protocol disabler (CVE-2022-30190 patch tool)

2 2022-06-26
suenerve/CVE-2022-30190-Follina-Patch

The CVE-2022-30190-follina Workarounds Patch

2 2022-06-05
arozx/CVE-2022-30190

A very simple MSDT "Follina" exploit **patched**

2 2022-11-01
SrikeshMaharaj/CVE-2022-30190

Follina POC by John Hammond

2 2022-06-03
amitniz/follina_cve_2022-30190

proof of concept to CVE-2022-30190 (follina)

2 2022-06-11
SonicWave21/Follina-CVE-2022-30190-Unofficial-patch

An Unofficial Patch Follina CVE-2022-30190 (patch) by micrisoft Guidelines.

2 2022-06-14
Zitchev/go_follina

Follina (CVE-2022-30190) proof-of-concept

2 2023-02-21
jeffreybxu/five-nights-at-follina-s

A Fullstack Academy Cybersecurity project examining the full cycle of the Follina (CVE-2022-30190) vulnerability, from exploit to detection and defens

2 2022-08-05
winstxnhdw/CVE-2022-30190

A proof of concept for CVE-2022-30190 (Follina).

2 2025-11-24
rickhenderson/cve-2022-30190

Aka Follina = benign POC.

1 2022-05-31
kdk2933/msdt-CVE-2022-30190

CVE-2022-30190- A Zero-Click RCE Vulnerability In MSDT

1 2022-05-31
derco0n/mitigate-folina

Mitigates the "Folina"-ZeroDay (CVE-2022-30190)

1 2022-06-08
IamVSM/msdt-follina

Microsoft MS-MSDT Follina (0-day Vulnerability) CVE-2022-30190 Attack Vector

1 2022-06-06
joshuavanderpoll/CVE-2022-30190

Microsoft Support Diagnostic Tool (CVE-2022-30190)

1 2022-06-07
b401/Clickstudio-compromised-certificate

Repository containing the compromised certificate seen in recent CVE-2022-30190 (Follina) attacks.

1 2022-06-09
1 2022-12-29
ToxicEnvelope/FOLLINA-CVE-2022-30190

Implementation of FOLLINA-CVE-2022-30190

1 2023-08-27
hycheng15/CVE-2022-30190

An exploitation of CVE-2022-30190 (Follina)

1 2023-11-14
Jump-Wang-111/AmzWord

An automated attack chain based on CVE-2022-30190, 163 email backdoor, and image steganography.

1 2023-11-28
alienkeric/CVE-2022-30190

The script is from https://github.com/JohnHammond/msdt-follina, just make it simple for me to use it and this script aim at generating the payload fo

1 2024-04-09
ImVihanga03/Static-Malware-Analysis-Follina-CVE-2022-30190

Static Malware Analysis of Follina (CVE-2022-30190) from Blue Team Labs Online

1 2026-04-01
DOV3Y/CVE-2022-30190-ASR-Senintel-Process-Pickup

Picking up processes that have triggered ASR related to CVE-2022-30190

0 2022-05-31
rayorole/CVE-2022-30190

CVE-2022-30190 or "Follina" 0day proof of concept

0 2022-06-01
ImproveCybersecurityJaro/2022_PoC-MSDT-Follina-CVE-2022-30190

Proof of Concept zu MSDT-Follina - CVE-2022-30190. ÜBERPRÜFUNG DER WIRKSAMKEIT VON MICROSOFT DEFNEDER IN DER JEWEILS AKTUELLSTEN WINDOWS 10 VERSION.

0 2022-06-01
castlesmadeofsand/ms-msdt-vulnerability-pdq-package

PDQ Package I created for CVE-2022-30190

0 2022-06-08
0 2022-06-03
droidrzrlover/CVE-2022-30190

This is to patch CVE-2022-30190. Use at your own risk.

0 2022-06-03
hilt86/cve-2022-30190-mitigate

Powershell script to mitigate cve-2022-30190

0 2022-06-03
abhirules27/Follina

Notes related to CVE-2022-30190

0 2022-06-07
cyberdashy/CVE-2022-30190

Mitigation for CVE-2022-30190

0 2022-06-10
Abdibimantara/CVE-2022-30190-Analysis-With-LetsDefends-Lab

this is my simple article about CVE 2022-30190 (Follina) analysis. I use the lab from Letsdefend.

0 2022-06-10
JotaQC/CVE-2022-30190_Temporary_Fix

These are two Python scripts compiled to easily and quickly apply temporary protection against the CVE-2022-30190 vulnerability (Follina)

0 2022-06-26
JotaQC/CVE-2022-30190_Temporary_Fix_Source_Code

These are the source codes of the Python scripts to apply the temporary protection against the CVE-2022-30190 vulnerability (Follina)

0 2022-06-21
nanaao/PicusSecurity4.Week.Repo

CVE-2022-30190 : CVE 0-day MS Offic RCE aka msdt follina

0 2022-06-12
XxToxicScriptxX/CVE-2022-30190

Python file scanner created in 2021 scanning for known and potential vulns

0 2022-06-13
Cerebrovinny/follina-CVE-2022-30190

follina zero day vulnerability to help Microsoft to mitigate the attack

0 2022-06-16
Imeneallouche/Follina-attack-CVE-2022-30190-

this is a demo attack of FOLLINA exploit , a vulnerability that has been discovered in May 2022 and stood unpatched until June 2022

0 2022-10-06
mattjmillner/CVE-Smackdown

Implementation of CVE-2022-30190 in C

0 2022-11-10
Nyx2022/Follina-CVE-2022-30190-Sample

Educational Follina PoC Tool

0 2022-12-07
shri142/ZipScan

A tool written in Go that scans files & directories for the Follina exploit (CVE-2022-30190)

0 2024-02-24
ethicalblue/Follina-CVE-2022-30190-Sample

Educational exploit for CVE-2022-30190

0 2024-07-20
Potato-9257/CVE-2022-30190_page

PoC of CVE-2022-30190

0 2025-02-07
yeep1115/ICT287_CVE-2022-30190_Exploit

Project on CVE-2022-30190 exploitation and mitigation strategies

0 2025-03-02
RathoreAbhiii/Folina-Vulnerability-Exploitation-Detection-and-Mitigation

Project Repository for Exploitation, Detection and Mitigation of Folina Vulnerability (CVE-2022-30190)

0 2025-04-08
seinab-ibrahim/Follina-Vulnerability-CVE-2022-30190-Exploit-Analysis

Exploration of the Follina (CVE-2022-30190) Microsoft Office vulnerability, including a detailed analysis, proof-of-concept exploitation in a controll

0 2025-08-14
Arkha-Corvus/LetsDefend-SOC173-Follina-0-Day-Detected

We are presented with a security alert indicating the detection of the Follina (CVE-2022-30190) vulnerability. A malicious Word document triggered msd

0 2025-10-18
shndnth/CVE-2022-30190

Educational Proof-of-Concept for the CVE-2022-30190 (Follina) vulnerability.

0 2026-04-10
u1tr0nex/CVE-2022-30190-Follina-Lab

Full exploit chain lab and Suricata IDS detection for CVE-2022-30190 (Follina) - MSDT RCE

0 2026-05-09
92 repos — triés par ⭐ Rechercher sur GitHub ↗

Signal Intelligence

Confidence
92%
EPSS 93.53%
CVSS v3.1 7.8
Mentions 20
Last Seen Feb 25, 2025

CNA Information

CNA Assigner
microsoft
CNA Title
Microsoft Windows Support Diagnostic Tool (MSDT) Remote Code Execution Vulnerability

Analyst Note

CVE-2022-30190 (Follina) is a well-documented remote code execution vulnerability affecting Microsoft Office through the MSDT protocol handler, with high CVSS score (7.8) and confirmation by Google Project Zero. Multiple security advisories from CERT-EU and widespread coverage substantiate the vulnerability's authenticity and severity in real-world exploitation scenarios.

Threat Actors 47

Lazarus Group
apt_group Information theft and espionage 🇰🇵 KP
Turla Group
apt_group Information theft and espionage Russian Federation
APT 29
apt_group Information theft and espionage 🇷🇺 RU
Mustang Panda
apt_group Information theft and espionage 🇨🇳 CN
WIZARD SPIDER
apt_group Financial gain 🇷🇺 RU
Cobalt
apt_group Financial crime 🇷🇺 RU
FIN7
apt_group Financial crime 🇷🇺 RU
Kimsuky
apt_group Information theft and espionage 🇰🇷 KR
SaintBear
apt_group Information theft and espionage 🇷🇺 RU
MageCart
apt_group Financial gain 🇷🇺 RU
CHRYSENE
apt_group Information theft and espionage 🇮🇷 IR
Vicious Panda
apt_group Information theft and espionage 🇨🇳 CN
Harvester
apt_group Information theft and espionage Unknown
Leviathan
apt_group Information theft and espionage 🇨🇳 CN
BelialDemon
apt_group 🇷🇺 RU
Ghostwriter
apt_group 🇧🇾 BY
MAGNALLIUM
apt_group Sabotage and destruction 🇮🇷 IR
GOLD PRELUDE
apt_group 🇷🇺 RU
Kinsing
apt_group 🇷🇺 RU
Tick
apt_group Information theft and espionage 🇨🇳 CN
HAZY TIGER
apt_group Information theft and espionage 🇮🇳 IN
TA505
apt_group Financial gain 🇷🇺 RU
Infy
apt_group Information theft and espionage 🇮🇷 IR
TA570
apt_group 🇷🇺 RU
TeamTNT
apt_group 🇩🇪 DE
Lucky Cat
apt_group Information theft and espionage 🇨🇳 CN
TA428
apt_group Information theft and espionage 🇨🇳 CN
Callisto
apt_group Information theft and espionage 🇷🇺 RU
Pirate Panda
apt_group Information theft and espionage 🇨🇳 CN
Storm-2077
apt_group Information theft and espionage 🇨🇳 CN
TAG-100
apt_group Information theft and espionage 🇨🇳 CN
TA413
apt_group Information theft and espionage 🇨🇳 CN
RomCom
apt_group Financial gain 🇷🇺 RU
FIN8
apt_group Financial crime 🇷🇺 RU
APT31
apt_group Information theft and espionage 🇨🇳 CN
POLONIUM
apt_group Information theft and espionage 🇱🇧 LB
APT 22
apt_group Information theft and espionage 🇨🇳 CN
Rocke
apt_group 🇨🇳 CN
RedAlpha
apt_group Information theft and espionage 🇨🇳 CN
Bitwise Spider
apt_group Financial gain 🇷🇺 RU
Pat Bear
apt_group 🇸🇾 SY
Gelsemium
apt_group Information theft and espionage 🇨🇳 CN
Shadow Network
apt_group Information theft and espionage 🇨🇳 CN
Operation Olympic Games
apt_group Sabotage and destruction 🇺🇸 US
Mana Team
apt_group 🇨🇳 CN
Operation Shadow Force
apt_group 🇨🇳 CN
Operation Black Atlas
apt_group Financial crime

Triage Info

Decided atMar 03, 2026
Published DateJun 01, 2022