Microsoft has documented these feature control keys and recommends enabling specific feature control keys for security reasons.See the following: Microsoft strongly encourages all users of Microsoft Office to review the security-related feature control keys and to enable them.
Refer to the following table for the registry key version string to set for each Office version: Impact of mitigation: Setting this registry key will disable automatic update for DDE field and OLE links.
Windows 10 Fall Creators Update (version 1709) Users of the Windows 10 Fall Creators Update can leverage Windows Defender Exploit Guard to block DDE-based malware with Attack surface reduction (ASR) rules.
In no event shall Microsoft Corporation or its suppliers be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages, even if Microsoft Corporation or its suppliers have been advised of the possibility of such damages.
Some states do not allow the exclusion or limitation of liability for consequential or incidental damages so the foregoing limitation may not apply.
For more information and to download the update, see ADV170021.
Users who wish to take immediate action can protect themselves by manually creating and setting registry entries for Microsoft Office.Microsoft Publisher A Word document using the DDE protocol that is imbedded within a Publisher document could be a possible attack vector.You can help prevent this attack vector by applying the Word registry key modification.In an email attack scenario, an attacker could leverage the DDE protocol by sending a specially crafted file to the user and then convincing the user to open the file, typically by way of an enticement in an email.The attacker would have to convince the user to disable Protected Mode and click through one or more additional prompts.To learn more about Windows Defender Exploit Guard and Windows Defender ATP, see: The information provided in this advisory is provided "as is" without warranty of any kind.