Office COM kill bit for Shockwave Flash Object
The `Compatibility Flags` `DWORD` value set to `1024` (`0x00000400`) applies the Office COM kill bit to CLSID `{D27CDB6E-AE6D-11CF-96B8-444553540000}`.
since 0.9.8.11
Purpose
Show registry keys (1)
HKLM\software\microsoft\Office\Common\COM Compatibility\{D27CDB6E-AE6D-11CF-96B8-444553540000}\Compatibility Flags
The Compatibility Flags DWORD value set to 1024 (0x00000400) applies the Office COM kill bit to CLSID {D27CDB6E-AE6D-11CF-96B8-444553540000}. This CLSID identifies the Shockwave Flash Object ActiveX control.
The kill bit prevents supported Microsoft Office applications from activating this COM object within an Office process. The mechanism covers ActiveX controls and OLE objects registered with the specified CLSID.
Notes
Additional effects
With the updated Office security components, the block is not limited to Flash objects embedded in or linked from Office documents. Unless the scope is separately limited by ActivationFilterOverride, Office also blocks other in-process activation paths, such as an add-in attempting to load the COM object.
This value does not uninstall Adobe Flash Player or establish a system-wide ActiveX kill bit. It does not prevent other applications from using the control. Microsoft’s related security bulletin specifically notes that the Office setting does not block Flash Player in Internet Explorer.
Security
Blocking activation reduces the Office attack surface by preventing documents, add-ins, and other components running inside Office from instantiating the specified Flash control. This also mitigates attacks that attempt to exploit vulnerabilities in the control through specially crafted Office content.
The protection is limited to the specified CLSID and to Office processes. This single value does not automatically block other Flash COM classes, browsers, or applications.
Possible side effects
Office documents, templates, forms, or add-ins that depend on the Shockwave Flash Object can no longer load or run their Flash content. Affected content might be displayed incompletely or produce an error.
Notes
According to Microsoft, the unversioned registry location shown here applies to Office 2010 and Office 2013 in the applicable registry view. For 32-bit Office on 64-bit Windows, the corresponding location is under HKLM\Software\Wow6432Node\Microsoft\Office\Common\COM Compatibility\.... Office 2016 instead uses a version-specific location under Microsoft\Office\16.0\Common\COM Compatibility. The effect of this exact value should therefore not be assumed for those other paths or Office versions.
Microsoft also lists Shockwave Flash Object in its snapshot of COM controls whose activation is blocked by default in the documented Office versions.
Microsoft documentation
Microsoft Support: Security Settings for COM objects in Office
Microsoft Learn: Microsoft Security Bulletin MS16-093