Form Controls stop working after December 2014 Updates (Updated March 10, 2015)

For some users, Form Controls (FM20.dll) are no longer working as expected after installing MS14-082 Microsoft Office Security Updates for December 2014. Issues are experienced at times such as when they open files with existing VBA projects using forms controls, try to insert a forms control in to a new worksheet or run third party software that may use these components.

https://technet.microsoft.com/en-us/library/security/ms14-082.aspx

You may receive errors such as:

  • "Cannot insert object"
  • "Object library invalid or contains references to object definitions that could not be found"
  • "The program used to create this object is Forms. That program is either not installed on your computer or it is not responding. To edit this object, install Forms or ensure that any dialog boxes in Forms are closed."    

* Note In this last error message, the Forms text may also be replaced by the GUID of the control.

Additionally, you may be unable to use or change properties of an ActiveX control on a worksheet or receive an error when trying to refer to an ActiveX control as a member of a worksheet via code.

STATUS: Update March 10, 2015:  

Hotfixes for this issue have been released in the March 2015 Updates for Office 2007, 2010 & 2013. Refer to the articles below for more details and any pre-requisites required.  
* Note: MS14-082 fm20.dll changes were not released for Office 2003. As Office 2003 is fully out of support, there is no update being released for this version.

Support Availability for Office 2003 and Office 2000
https://technet.microsoft.com/en-us/library/dd873564(v=office.12).aspx\#section1

 
- To address all issues in Office 2007, Office 2010 and/or Office 2013 MSI installs, you will need to install each update listed for the particular Office version below to fully resolve the issues.

MS15-022 Microsoft Office Security Update on it's own does not contain all of the files required to be updated in order to resolve each of the issues that may occur after installing MS14-082.

  • If you have multiple versions of Office installed, you will need to install each update listed for each version beginning with the older version of Office.
  • If for example, you have a mixed environment such as Lync 2013 or Outlook 2013 installed with Office 2010, you will need the FM20 update for Office 2013 in addition to all updates for Office 2010.
  • For Office 2007, the install requirements differ. The MSO update is required prior to installing the other Office 2007 updates and there is no update for Access 2007.

- For Office 365 or Office 2013 Click-to-Run (C2R) installs, you will need to update to the release build for March 2015. Triggering an update or an Online Repair of Office 365 via Programs and Features will include the updates. 

   Update Office 2013 or Office 365
https://support.microsoft.com/gp/office-2013-365-update/

OFFICE 2013
FM20 March 10, 2015 update for Office 2013 (KB2920754) https://support.microsoft.com/kb/2920754
Excel March 10, 2015 update for Excel 2013 (KB2956145) https://support.microsoft.com/kb/2956145
Word MS15-022: Description of the security update for Word 2013: March 10, 2015 (KB2956163) https://support.microsoft.com/kb/2956163
PowerPoint March 10, 2015 update for PowerPoint 2013 (KB2965206)

https://support.microsoft.com/kb/2965206

Access March 10, 2015 update for Access 2013 (KB2956176)

https://support.microsoft.com/kb/2956176

Visio March 10, 2015 update for Visio 2013 (KB2956155)

https://support.microsoft.com/kb/2956155

OFFICE 2010
FM20 March 10, 2015 update for Office 2010 (KB2920813)

https://support.microsoft.com/kb/2920813

Excel MS15-022: Description of the security update for Microsoft Excel 2010: March 10, 2015 (KB2956142) https://support.microsoft.com/kb/2956142
Word MS15-022: Description of the security update for Microsoft Word 2010: March 10, 2015 (KB2956139) https://support.microsoft.com/kb/2956139
PowerPoint MS15-022: Description of the security update for Microsoft PowerPoint 2010: March 10, 2015 (KB2920812) https://support.microsoft.com/kb/2920812
Access March 10, 2015 update for Access 2010 (KB2837601) https://support.microsoft.com/kb/2837601
Visio March 10, 2015 update for Visio 2010 (KB2878283) https://support.microsoft.com/kb/2878283
OFFICE 2007*
MSO MS15-022: Description of the security update for the 2007 Microsoft Office Suite: March 10, 2015 (KB2984939) https://support.microsoft.com/kb/2984939
FM20 March 10, 2015 update for Office 2007 (KB2920794) https://support.microsoft.com/kb/2920794
Excel MS15-022: Description of the security update for Microsoft Excel 2007 SP3: March 10, 2015 (KB2956103) https://support.microsoft.com/kb/2956103
Word MS15-022: Description of the security update for Microsoft Word 2007 SP3: March 10, 2015 (KB2956109) https://support.microsoft.com/kb/2956109
PowerPoint MS15-022: Description of the security update for Microsoft PowerPoint 2007 SP3: March 10, 2015 (KB2899580) https://support.microsoft.com/kb/2899580
Visio March 10, 2015 update for Visio 2007 (KB2817561) https://support.microsoft.com/kb/2817561

    * IMPORTANT NOTE: Office 2007 differs in install list; you will need to update MSO before the other updates are applied. There is no Access patch needed for 2007.

OFFICE 2003 Mixed Environment (ie. Office 2003 + Lync 2013, Outlook 2013 or SharePoint Designer 2013, etc.)

Office 2003 is fully out of support. Therefore, when installed on it's own, the MS14-082 update did not affect this version of Office.  However, if you are using a mixed environment on which the December MS14-082 Security Update would then have been installed for a later version of Office, you may experience the issues as explained in this blog.  

The December security update is introducing a kill-bit for the ActiveX controls (fm20.dll) and is a critical update. It is not recommended to uninstall or not install a security update as it leaves you open to vulnerabilities. The only workaround in this situation would be to update to the December MS14-082 Security Update for fm20.dll and remove the .exd files as in the original workarounds provided. Moving forward, do not install any non-critical updates for fm20.dll such as the March 2015 updates above.

Automated Workaround Solution:

FixIt solutions are available in KB 3025036 to remove the .exd files.  

* Close the Office applications prior to running the FixIt solutions. *

3025036 "Cannot insert object" error in an ActiveX custom Office solution after you install the MS14-082 security update
https://support.microsoft.com/kb/3025036/EN-US

Manual steps:

After updating, the cached control type libraries (extender files) may be out of sync. To resolve this issue, you must delete the cached versions of the control type libraries (extender files) on the client computer. To do this, perform a search on your hard disk for files that have the ".exd" file name extension and delete all the .exd files that you find. These .exd files will be re-created automatically when you use the new controls the next time that you use VBA. These extender files will be under the user's profile and may also be in other locations, such as the following: 

  • %appdata%\microsoft\forms
  • %temp%\excel8.0
  • %temp%\word8.0
  • %temp%\PPT11.0
  • %temp%\vbe

Notes:  

  • Ensure that your file extensions are viewable prior to performing the search.
  • Close all Microsoft Office applications prior to deleting the files.
  • If the search above does not find any .exd files and the issue persists:
    •  In Windows Explorer, open the %TEMP% folder, search for "MSForms.exd" in all subfolders and delete all instances of that file that are found (including those in the subfolders).
       Do the same for the %APPDATA% folder and subfolders.

Scripting solution:

Because this problem may affect more than one machine, it is also possible to create a scripting solution to delete the EXD files and run the script as part of the logon process using a policy. The script you would need should contain the following lines and would need to be run for each USER as the .exd files are USER specific.

del %temp%\vbe\*.exd

del %temp%\excel8.0\*.exd

del %appdata%\microsoft\forms\*.exd

del %appdata%\microsoft\local\*.exd

del %temp%\word8.0\*.exd

del %temp%\PPT11.0\*.exd

Additional step:

If the steps above do not resolve your issue, and you feel it may be file specific, another step that can be tested (see warning below):

1. On a fully updated machine and after removing the .exd files, open the file in Excel with edit permissions.

2. Open Visual Basic for Applications > modify the project by adding a comment or edit of some kind to any code module  > Debug > Compile VBAProject.

3. Save and reopen the file. Test for resolution.

If resolved, provide this updated project to additional users.

Warning: If this step resolves your issue, be aware that after deploying this updated project to the other users, these users will also need to have the updates applied on their systems and .exd files removed as well.

If this does not resolve your issue, it may be a different issue and further troubleshooting may be necessary. Please open a support ticket to report the issue.

References with further information:  

3025036 "Cannot insert object" error in an ActiveX custom Office solution after you install the MS14-082 security update
https://support.microsoft.com/kb/3025036/EN-US

3017349 MS14-082: Vulnerabilities in Microsoft Office could allow remote code execution: December 9, 2014
https://support.microsoft.com/kb/3017349/EN-US

2726958 MS14-082: Description of the security update for Microsoft Office 2013: December 9, 2014
https://support.microsoft.com/kb/2726958/EN-US

2553154 MS14-082: Description of the security update for Microsoft Office 2010: December 9, 2014
https://support.microsoft.com/kb/2553154/EN-US

2596927 MS14-082: Description of the security update for the 2007 Microsoft Office suite: December 9, 2014
https://support.microsoft.com/kb/2596927/EN-US

Additional Notes:

  • If you are using a system with multiple versions of Office installed, all versions will need to be updated at the same time or other problems may exist. If you are creating new workbooks using the new controls on an updated machine, these workbooks then require all clients to have this update installed or they will error when the book is shared.
  • Example: Office 2010 Suite + Lync 2013 would require both the Security Update for Office 2010 and Office 2013 to be applied.  

Another behavior has been reported concerning the default naming of a control. A '2' is getting concatenated in the name causing for example, the Command Button to create the first control as CommandButton21 rather than CommandButton1.   

This issue is also being reviewed.