Disable the Flash ActiveX control using the Office kill bit
The `Compatibility Flags` value is a `REG_DWORD`.
since 0.9.8.11
Purpose
Show registry keys (1)
HKLM\software\WOW6432Node\Microsoft\Office\Common\COM Compatibility\{D27CDB6E-AE6D-11CF-96B8-444553540000}\Compatibility Flags
The Compatibility Flags value is a REG_DWORD. Setting its data to 1024 (0x00000400) prevents Microsoft Office from activating the COM object identified by CLSID {D27CDB6E-AE6D-11CF-96B8-444553540000}. Microsoft identifies this ActiveX control as Shockwave Flash Object.
The Office COM kill bit originally applied when a COM object was embedded in or linked from an Office document. Following an update to the kill-bit behavior, Office completely blocks in-process activation of the specified object. This broader behavior also covers activation through other mechanisms, including add-ins.
The restriction applies to the object’s use within Office. It does not disable the Flash ActiveX control system-wide and is distinct from the Internet Explorer ActiveX kill bit.
Notes
Security
The kill bit prevents Office documents, add-ins, and other components running inside an Office process from activating the specified Flash COM object. This removes a potential attack path through that ActiveX control. It does not protect against vulnerabilities in other COM objects or prevent the control from being activated outside Office.
Microsoft now also includes this CLSID in its list of controls that Office blocks from activation by default. Depending on the Office version and update level, the explicit registry value may therefore reinforce a block that is already present.
Possible side effects
Office documents and add-ins that depend on the Flash ActiveX control can no longer load the affected content or functionality. Embedded Flash content may not appear or operate as intended.
Notes
The WOW6432Node location applies to 32-bit Office running on 64-bit Windows. Microsoft documents this unversioned Office\Common path for Office 2010 and Office 2013. For Office 2016, Microsoft documents a version-specific location under Office\16.0\Common; this registry value should therefore not be assumed to apply unchanged to other Office architectures or versions.
Microsoft documentation
Microsoft Support: Security Settings for COM objects in Office
Microsoft Learn: Microsoft Security Bulletin MS15-131 — Critical