Disable additional security checks on VBA library references that may refer to unsafe locations on the local machine
This per-user registry value controls additional path checks for library references in VBA projects.
since 0.9.8.11
Purpose
Show registry keys (1)
HKCU\software\policies\microsoft\vba\security\disablestrictvbarefssecurity
This per-user registry value controls additional path checks for library references in VBA projects. References to type libraries (*.olb, *.tlb, *.dll), executable files (*.exe), and ActiveX controls (*.ocx) can be affected.
The value is a REG_DWORD. A value of 1 prevents VBA from performing the additional checks that detect library paths pointing to potentially unsafe locations on the local computer. VBA then checks project references only against the registry and trusted zones. A value of 0, or an absent value, leaves the additional security checks in effect.
This setting does not enable macros or disable other VBA or Office security policies.
Notes
Security
Setting the value to 1 weakens protection against malicious or otherwise unsafe libraries. A specially crafted Office document can contain a VBA reference to a library in a local path that the user or an attacker can influence. Loading a malicious library can result in code execution with the signed-in user's permissions.
The additional checks are part of an Office behavior change introduced by Microsoft in connection with CVE-2020-0760. That vulnerability involved Microsoft Office improperly loading arbitrary type libraries.
Possible side effects
When the additional checks remain active, legacy VBA solutions can fail if they reference libraries through paths that Office now considers unsafe. Office can treat the reference as a missing library and display an error such as “Can't find project or library.”
A value of 1 can restore compatibility for such solutions, but does so by removing the corresponding path-based security check.
Notes
The setting applies to the current user. Its effect requires an Office version containing the VBA library-reference security changes introduced in April 2020. Microsoft identifies Microsoft 365 Apps, Office 2016, Office 2013, and Office 2010 with the applicable security updates as affected products.
Microsoft documentation
Microsoft Learn: Microsoft 365 Apps for Enterprise security baseline settings reference
Microsoft Support: FAQ for VBA solutions affected by April 2020 Office security updates