What is the DIAGCAB file format?
.diagcab files contain a package of data, typically compressed, used in Windows system troubleshooting. The format is a standard Microsoft Cabinet archive - identifiable by the MSCF magic bytes at offset 0 - carrying a Windows Troubleshooting Pack: an XML answer file plus PowerShell scripts that define the diagnostic workflow. .diagcab was introduced with Windows 7 as part of the Windows Troubleshooting Platform (WTP); earlier Windows versions did not support it natively.
The .diagcab format is used by the Microsoft Support Diagnostic Tool, available as part of WTP - Windows' built-in problem diagnostics platform. A .diagcab pack can be used for identifying and fixing problems and errors in software, drivers, and devices used by the Windows system. Because the container is an ordinary .cab archive, its contents can also be inspected or generated with tools such as makecab.exe, Cabarc.exe, or any compatible archiver.
.diagcab files can be supplied by various independent hardware manufacturers together with the dedicated diagnostics software they ship with their products. They may also be delivered by system administrators via Group Policy or deployment tools. .diagcab files are typically digitally signed for authentication and security.
To run a .diagcab troubleshooter, double-click it or invoke msdt.exe with the /cab switch. This launches a Wizard that guides the user step-by-step through the troubleshooting process and may submit a diagnostic report for further analysis. Note that msdt.exe was deprecated in Windows 11 22H2 (October 2022) following the Follina vulnerability (CVE-2022-30190); Microsoft has been migrating built-in troubleshooters to the Get Help app and .diagpkg packages.
Security & safety
RISK: HIGHA .diagcab runs PowerShell scripts through msdt.exe, so it can change system settings and execute code - treat it like a program, not a harmless data file. Only run .diagcab files that come directly from Microsoft or a vendor you trust; never one received by email/chat or from a random site. This format was central to the 2022 "Follina" (CVE-2022-30190) and "DogWalk" (CVE-2022-34713) remote-code-execution attacks, which abused crafted .diagcab/msdt handling and the fact that CAB files didn't show the usual Mark-of-the-Web warning. Microsoft has since patched msdt, added warnings, and is deprecating the legacy troubleshooter platform; keep Windows updated, and if in doubt open the .diagcab in 7-Zip to inspect its scripts before running, or use Settings → Troubleshoot instead.
Format details
in a nutshellPrograms that open DIAGCAB files
Windows3 apps
Microsoft Support Diagnostic Tool (msdt.exe / built-in)
Built-in Double-click the .diagcab to launch the troubleshooting wizard (only if it's from a trusted source). On Windows 11, prefer Settings → System → Troubleshoot for built-in fixes.
7-Zip (to inspect contents)
Open-source Right-click → 7-Zip → Open archive to see the scripts/answer file inside without running them - useful to vet an untrusted .diagcab.
Windows Explorer / Makecab (CAB tooling)
Built-in Windows can open the CAB to view files; makecab/expand are the command-line tools for packing/unpacking cabinet contents. Technical details
deep spec| Container format | Microsoft Cabinet (CAB) archive; binary structure is identical to standard `.cab` files |
| Magic bytes | `4D 53 43 46` (ASCII `MSCF`) at offset 0 - standard Microsoft Cabinet header |
| MIME type | `application/vnd.ms-cab-compressed` |
| Developer | Microsoft Corporation |
| Introduced | Windows 7 (2009) alongside the Windows Troubleshooting Platform (WTP) |
| Pack contents | XML manifest/answer file and one or more PowerShell `.ps1` scripts defining detection and resolution logic |
| Scripting language | Windows PowerShell - embedded scripts perform automated detection, diagnosis, and remediation |
| Default handler | `msdt.exe /cab <file>` - Microsoft Support Diagnostic Tool (deprecated in Windows 11 22H2) |
| Execution UI | Wizard-driven GUI that guides the user step-by-step through detection, diagnosis, and fix steps |
| Digital signature | Typically Authenticode-signed; Windows verifies the signature before allowing execution |
| Deployment methods | Direct download, OEM hardware bundles, Group Policy, SCCM, or Windows Update |
| CAB compression | Supports LZX and MSZIP compression algorithms inherited from the Microsoft Cabinet format |
| Deprecation status | `msdt.exe` and `.diagcab` execution deprecated in Windows 11 22H2 (Oct 2022) due to CVE-2022-30190 (Follina); Get Help app is the designated successor |
| File association | Registered on Windows 7+ to open with `msdt.exe`; archive contents inspectable with any `.cab`-compatible tool |
| Released | Windows 7 (2009) - Windows Troubleshooting Platform (WTP) |
| Specification | learn.microsoft.com |
DIAGCAB conversions
Community Q&A
asked by usersNo questions yet - be the first to ask about DIAGCAB files.
