Coverage Advisory for CVE-2022-30190

This advisory describes CVE-2022-30190, a remote code execution vulnerability in Windows where malicious Word/RTF documents abuse the MS-MSDT URI scheme to execute PowerShell without needing the usual macro prompts; active malicious samples were observed and Microsoft published guidance. The document lists affected Windows versions, recommends disabling the ms-msdt URL protocol and the Windows Explorer preview pane as mitigations, and notes Zscaler detection signatures and sandbox detection for this exploit.