High · published June 2, 2022
CVSS calls it high at 7.8. It is confirmed in active exploitation. It sits in the 99.9th percentile for exploit probability.
🚨 A crafty URL can turn your Word document into a gateway for remote code execution! 💻 Think of it like a restaurant that lets in any delivery driver without checking their ID. If an attacker sends a specially crafted delivery notice (the URL), they could serve up malicious code right from your Word app! If exploited, an attacker could run arbitrary code with the same privileges as the calling application—meaning they can install programs, view, change, or even delete your data, or create new accounts. This high-severity vulnerability could lead to significant data loss or system compromise, and it’s already been exploited in the wild! 🔥
Think of it like a restaurant that lets in any delivery driver without checking their ID. If an attacker sends a specially crafted delivery notice (the URL), they could serve up malicious code right from your Word app! This vulnerability occurs when the Microsoft Support Diagnostic Tool (MSDT) is invoked via a URL protocol from a calling application like Word, allowing remote code execution without proper authorization checks.
If exploited, an attacker could run arbitrary code with the same privileges as the calling application—meaning they can install programs, view, change, or even delete your data, or create new accounts. This high-severity vulnerability could lead to significant data loss or system compromise, and it’s already been exploited in the wild! 🔥 To protect your system, immediately disable the MSDT URL protocol by editing the registry, and ensure you're running the latest security updates from Microsoft. It's also wise to educate users on the risks associated with opening unexpected documents! 🛡️ You've got this! Follow these steps, and you'll lock down your systems like a pro! 🔒💪
| Product | Versions | Fixed in |
|---|---|---|
| microsoft/windows_10_1507 | < 10.0.10240.19325 | 10.0.10240.19325 |
| microsoft/windows_10_1607 | < 10.0.14393.5192 | 10.0.14393.5192 |
| microsoft/windows_10_1809 | < 10.0.17763.3046 | 10.0.17763.3046 |
| microsoft/windows_10_20h2 | < 10.0.19042.1766 | 10.0.19042.1766 |
| microsoft/windows_10_21h1 | < 10.0.19043.1766 | 10.0.19043.1766 |
| microsoft/windows_10_21h2 | < 10.0.19044.1766 | 10.0.19044.1766 |
| microsoft/windows_11_21h2 | < 10.0.22000.739 | 10.0.22000.739 |
| microsoft/windows_7 | all versions | — |
| microsoft/windows_8.1 | all versions | — |
| microsoft/windows_rt_8.1 | all versions | — |
| microsoft/windows_server_2008 | all versions | — |
| microsoft/windows_server_2012 | all versions | — |
| microsoft/windows_server_2012 | all versions | — |
| microsoft/windows_server_2016 | < 10.0.14393.5192 | 10.0.14393.5192 |
| microsoft/windows_server_2019 | < 10.0.17763.3046 | 10.0.17763.3046 |
| microsoft/windows_server_2022 | < 10.0.20348.770 | 10.0.20348.770 |
| microsoft/windows_server_20h2 | < 10.0.19042.1766 | 10.0.19042.1766 |