What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
In May 2022, researchers reported a malicious Word document that could trigger PowerShell through the Windows Support Diagnostic Tool, even with Office macros disabled. The incident became known as Follina, or CVE-2022-30190. It is a historical vulnerability report—not a newly discovered 2026 zero-day—and the observed attack used Office as its delivery route to a Windows component.
What happened in the 2022 Follina report?
On May 27, 2022, researcher nao_sec said they had found a malicious document on VirusTotal. SecurityWeek reported on May 30 that the file had been uploaded from Belarus and was designed to execute arbitrary PowerShell code when opened. Kevin Beaumont and other researchers then analyzed its behavior. SecurityWeek’s contemporaneous report describes the sample and the researchers’ observations.
The incident was initially framed as a Microsoft Office zero-day because a Word file delivered the exploit. Microsoft’s vulnerability mapping identifies CVE-2022-30190 as a remote code execution vulnerability in the Windows Support Diagnostic Tool (MSDT), not simply an Office code defect. Its summary describes a crafted Word document downloading HTML that runs commands and may retrieve further payloads. MITRE’s mapping also records the MSDT and document-execution context.
How did the observed attack chain work?
The reported chain connected four stages. Beaumont described it this way: “The document uses the Word remote template feature to retrieve a HTML file from a remote webserver, which in turn uses the ms-msdt MSProtocol URI scheme to load some code and execute some PowerShell,” he explained to SecurityWeek.
#1 Best Overall
- Classic Office Apps | Includes classic desktop versions of Word, Excel, PowerPoint, and OneNote for creating documents, spreadsheets, and presentations with ease.
- Install on a Single Device | Install classic desktop Office Apps for use on a single Windows laptop, Windows desktop, MacBook, or iMac.
- Ideal for One Person | With a one-time purchase of Microsoft Office 2024, you can create, organize, and get things done.
- Consider Upgrading to Microsoft 365 | Get premium benefits with a Microsoft 365 subscription, including ongoing updates, advanced security, and access to premium versions of Word, Excel, PowerPoint, Outlook, and more, plus 1TB cloud storage per person and multi-device support for Windows, Mac, iPhone, iPad, and Android.
- Word retrieves a remote template. The document used Word’s remote-template feature to fetch content from a web server.
- The server supplies HTML. The retrieved HTML included content that invoked the
ms-msdtprotocol URI scheme. - Windows invokes MSDT. The URI handler launched the Windows Support Diagnostic Tool as part of the exploit path.
- PowerShell runs. The chain could execute PowerShell commands and, as Microsoft’s mapping summarizes, could fetch additional payloads.
Beaumont said the observed behavior occurred even when macros were disabled. His reaction—“That should not be possible”—referred to the chain’s use of the MSDT handler despite the usual macro-based execution route being unavailable. A macro-only defense would therefore not have stopped this particular reported chain.
What did researchers observe about Office versions and viewing modes?
SecurityWeek said researchers tested the exploit against Office Pro Plus and Office 2013, 2016, and 2021. Beaumont reported that it did not appear to work against the latest Insider and Current Office versions available at that time. These are tests and observations from 2022, not a current compatibility matrix or a guarantee about any present-day Office configuration.
Rank #2
- Designed for Your Windows and Apple Devices | Install premium Office apps on your Windows laptop, desktop, MacBook or iMac. Works seamlessly across your devices for home, school, or personal productivity.
- Includes Word, Excel, PowerPoint & Outlook | Get premium versions of the essential Office apps that help you work, study, create, and stay organized.
- 1 TB Secure Cloud Storage | Store and access your documents, photos, and files from your Windows, Mac or mobile devices.
- Premium Tools Across Your Devices | Your subscription lets you work across all of your Windows, Mac, iPhone, iPad, and Android devices with apps that sync instantly through the cloud.
- Easy Digital Download with Microsoft Account | Product delivered electronically for quick setup. Sign in with your Microsoft account, redeem your code, and download your apps instantly to your Windows, Mac, iPhone, iPad, and Android devices.
The same report said the sample could trigger Protected View and that an RTF-converted document could run from Explorer’s preview pane without being opened. These are period-specific researcher observations; behavior can vary by software version and configuration, so they should not be generalized to all Office or Windows systems.
What do the name and sample details mean?
The report said the sample referenced “0438,” the telephone area code associated with Follina, a village in Italy. Beaumont used that reference to name the vulnerability. SecurityWeek also reported that the sample’s domain, written as xmlformats[.]com, was hosted by Namecheap and was removed after the provider was notified. These details describe the observed 2022 sample and infrastructure; they do not establish current domain status or identify who was behind the activity.
Rank #3
- THE ALTERNATIVE: The Office Suite Package is the perfect alternative to MS Office. It offers you word processing as well as spreadsheet analysis and the creation of presentations.
- LOTS OF EXTRAS:✓ 1,000 different fonts available to individually style your text documents and ✓ 20,000 clipart images
- EASY TO USE: The highly user-friendly interface will guarantee that you get off to a great start | Simply insert the included CD into your CD/DVD drive and install the Office program.
- ONE PROGRAM FOR EVERYTHING: Office Suite is the perfect computer accessory, offering a wide range of uses for university, work and school. ✓ Drawing program ✓ Database ✓ Formula editor ✓ Spreadsheet analysis ✓ Presentations
- FULL COMPATIBILITY: ✓ Compatible with Microsoft Office Word, Excel and PowerPoint ✓ Suitable for Windows 11, 10, 8, 7, Vista and XP (32 and 64-bit versions) ✓ Fast and easy installation ✓ Easy to navigate
What should readers know about Follina now?
CVE-2022-30190 should be understood as a Windows MSDT vulnerability that researchers showed could be triggered through a malicious Office document. The report is important because it demonstrated a path that did not rely on Office macros, but its version tests and behavioral observations belong to the 2022 reporting period.
For current vulnerability status, updates, and product-specific guidance, consult Microsoft’s live Security Update Guide entry for CVE-2022-30190 and guidance for the Windows products you use. The historical report alone does not establish today’s patch status, affected-product list, or a safe workaround.
Quick Recap
Best Value
![Microsoft Office Home & Business 2024 | Classic Desktop Apps: Word, Excel, PowerPoint, Outlook and OneNote | One-Time Purchase for 1 PC/MAC | Instant Download [PC/Mac Online Code]](https://m.media-amazon.com/images/I/41H8B5iqO4L._SL160_.jpg)
- [Ideal for One Person] — With a one-time purchase of Microsoft Office Home & Business 2024, you can create, organize, and get things done.
- [Classic Office Apps] — Includes Word, Excel, PowerPoint, Outlook and OneNote.
- [Desktop Only & Customer Support] — To install and use on one PC or Mac, on desktop only. Microsoft 365 has your back with readily available technical support through chat or phone.
Rank #4
- Designed for Your Windows and Apple Devices | Install premium Office apps on your Windows laptop, desktop, MacBook or iMac. Works seamlessly across your devices for home, school, or personal productivity.
- Includes Word, Excel, PowerPoint & Outlook | Get premium versions of the essential Office apps that help you work, study, create, and stay organized.
- Up to 2 TB Shared Cloud Storage | Store and access your documents, photos, and files from your Windows, Mac or mobile devices.
- Premium Tools Across Your Devices | Your subscription lets you work across all of your Windows, Mac, iPhone, iPad, and Android devices with apps that sync instantly through the cloud.
- Share Your Family Subscription | You can share all of your subscription benefits with up to 6 people for use across all their devices.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
