Security News > 2022 > May > Microsoft shares mitigation for Office zero-day exploited in attacks

Microsoft has shared mitigation measures to block attacks exploiting a newly discovered Microsoft Office zero-day flaw abused in the wild to execute malicious code remotely.

The bug is a Microsoft Windows Support Diagnostic Tool remote code execution vulnerability reported by crazyman of the Shadow Chaser Group.

"An attacker who successfully exploits this vulnerability can run arbitrary code with the privileges of the calling application," Microsoft explains.

Execute the command "Reg delete HKEY CLASSES ROOTms-msdt /f". After Microsoft releases a CVE-2022-30190 patch, you can undo the workaround by launching an elevated command prompt and executing the reg import filename command.

C. While Microsoft says that Microsoft Office's Protected View and Application Guard would block CVE-2022-30190 attacks, CERT/CC vulnerability analyst Will Dormann found that the security feature will not block exploitation attempts if the target previews the malicious documents in Windows Explorer.

According to Shadow Chaser Group's crazyman, the researchers who first spotted and reported the zero-day in April, Microsoft first tagged the flaw as not a "Security-related issue." Still, it later closed the vulnerability submission report with a remote code execution impact.

News URL

https://www.bleepingcomputer.com/news/microsoft/microsoft-shares-mitigation-for-office-zero-day-exploited-in-attacks/