Microsoft Support Diagnostic Tool 0-Day Vulnerability Being Actively Exploited

**Summary:** The bulletin describes CVE-2022-30190, a zero-day in the Microsoft Support Diagnostic Tool (MSDT) actively abused since April 2022 to execute arbitrary PowerShell via the ms-msdt URI handler from malicious Microsoft Office documents (including RTF) without requiring macros; it documents nation-state activity, available PoCs, and recommends temporarily disabling the ms-msdt URL protocol and/or disabling scripted diagnostics as mitigations while providing hunting guidance.