Allow VBA to load typelib references by path from untrusted intranet locations
This per-user Office policy controls whether Visual Basic for Applications can load type libraries and other project references through a path stored in the VBA project when that path points to an untrusted intranet location.
since 0.9.8.11
Purpose
Show registry keys (1)
HKCU\software\policies\microsoft\vba\security\allowvbaintranetreferences
This per-user Office policy controls whether Visual Basic for Applications can load type libraries and other project references through a path stored in the VBA project when that path points to an untrusted intranet location.
VBA first searches the registry for a referenced type library's GUID. If the library is not registered, VBA can fall back to the path recorded in the project. When this policy value is enabled, VBA treats intranet paths that are neither local nor in the system's Trusted Sites list like local paths and attempts to load the reference from them.
When the policy value is disabled or absent, VBA refuses to load an unregistered reference through such an intranet path. The policy does not remove the corresponding restriction for Internet locations.
Notes
Security
Allowing untrusted intranet paths expands the set of locations from which Office can load library files. A manipulated VBA project can contain an explicit reference path. If an attacker can supply or replace the file at that path, Office might load a malicious type library or another executable library reference.
The underlying restriction was introduced in connection with CVE-2020-0760, which Microsoft describes as a remote-code-execution vulnerability involving Office loading arbitrary type libraries incorrectly. Enabling this policy does not grant administrative privileges; loaded code ordinarily runs with the permissions of the Office process and the signed-in user.
Possible side effects
When the policy is disabled or not configured, existing VBA solutions can fail if they depend on unregistered type libraries, executable files, or ActiveX controls hosted on untrusted intranet servers. Depending on the reference, VBA can report the compile error “Can't find project or library.”
Affected references can include .olb, .tlb, .dll, .exe, and .ocx files.
Notes
allowvbaintranetreferences is a REG_DWORD value. A value of 1 permits loading from the intranet paths described above; 0 retains the restriction. An absent value results in the restrictive default behavior.
Microsoft documents the behavior introduced by the April 2020 Office security updates as applying to Office 365, Office 2016, Office 2013, and Office 2010. Current Office administrative templates continue to use the “Microsoft Office 2016” category for supported Microsoft 365 Apps and newer perpetual Office releases.
Microsoft documentation
Microsoft Support: FAQ for VBA solutions affected by April 2020 Office security updates
Microsoft Learn: References dialog box