KB5014699: Microsoft Office Security Update — MSDT Remote Code Execution (June 2022)
A malicious Word document executes arbitrary code via the ms-msdt URI handler without macros — works even in Protected View via the Preview Pane. Apply KB5014699; exploited by TA413 and Sandworm before a patch was available.
Attackers can execute arbitrary code with the permissions of the user who previews or opens the document. In corporate environments this typically means code execution as a domain user, which can be combined with privilege escalation to move laterally. The attack does not require enabling macros, bypassing a key user-awareness control.
Word documents can embed an OLE object that references a remote HTML file. The HTML file triggers the ms-msdt URI handler which passes attacker-controlled parameters to MSDT. The MSDT process executes a PowerShell payload with the privileges of the user who opened the document. Macros do not need to be enabled; the attack works via the Preview Pane.
Probably yes if any of these apply:
Affected OS versions
Follina was first disclosed on May 27, 2022, with an active exploitation sample. TA413 (a Chinese APT) was observed delivering malicious DOCX files targeting Tibetan organisations. Russian GRU-affiliated Sandworm used Follina against European government targets in the weeks before the June 2022 patch. The name "Follina" comes from the Italian town in the malware sample's path.
Manual download
For air-gapped servers or out-of-band deployment. Microsoft Update Catalog returns every OS-version variant of this update.
↗ Microsoft Update CatalogKB5014699Manual remediation steps
⏱ 20 minutes (Office update, no reboot required)Immediate Mitigation — Disable MSDT URI Handler
# Back up the registry key
reg export HKEY_CLASSES_ROOT\ms-msdt "$env:USERPROFILE\Documents\msdt-backup.reg"
# Delete the ms-msdt URI handler
reg delete HKEY_CLASSES_ROOT\ms-msdt /f
# Verify it is gone
reg query HKEY_CLASSES_ROOT\ms-msdt 2>&1
# Expected: ERROR: The system was unable to find the specified registry key.
Apply the Patch (KB5014699)
After Patching — Restore MSDT URI Handler
# Restore the registry key (required for Microsoft support tooling)
reg import "$env:USERPROFILE\Documents\msdt-backup.reg"
Verify Patch Applied
No tested PowerShell script for this entry yet. We’re prioritising automation based on user demand.
| Patch ID | CVE ID | Vulnerability Name / Type | CVSS | Reference |
|---|---|---|---|---|
| KB5014699 | CVE-2022-30190 | Microsoft Support Diagnostic Tool (MSDT) — msdt.exe | 7.8 | NVD ↗ |