Issue with Excel 2013 Update KB5002242 (August 9, 2022)

[German]Microsoft has released security update KB5002242 for Excel 2013 on August 9, 2022 (Patchday). The patch is supposed to eliminate both a vulnerability and a bug in this Excel version. However, there is feedback from readers on the blog that this update is causing problems. Addendum: There is a workaround with a registry hack, to surpress the open error. Addenum 2: Confirmed by Microsoft. In addition, there is another Excel problem someone reported, which I pack into this article.

Excel 2013 Update KB5002242

The Excel 2013 update KB5002242 closes the Microsoft Excel Security Feature Bypass Vulnerability CVE-2022-336. To exploit the vulnerability, an attacker must send a specially crafted file to a user with an affected version of Microsoft Excel and trick the user into opening it. The file could be sent via email or downloaded from a compromised website. An attacker who successfully exploited this vulnerability could bypass the Packager Object Filters feature.

The update further resolves an issue where shared workbooks in .xls format might not be merged correctly.

Update triggers an open error in xlsx files

Within my German blog, Sebastian has reached out to report an issue with Microsoft Excel 2013 in conjunction with the August 2022 updates. Sebastian writes (translated):

quick feedback – I don't know what patch it is due to but with Excel 2013 we now always get this error when opening:

The file format and the file extension of "….xlsx" do not match. Maybe the file is corrupted or not safe. You should not open it if you do not trust its source. Do you still want to open the file?"

German blog reader Stefan confirms the error on a terminal server with Excel 2013 and names update KB5002242 as the cause.

Had the same problem with Excel 2013 on a TS.
After removing the kb5002242, all is well again.
The phenomenon occurred only with long directory paths or file names.
If I shortened the file name, the file could be opened without error message.

And in this comment user Hauten reports trouble with KB5002242 when opening an XLSX on a DFS server via UNC. He got the message:

The file format and extension do not match.

If it sets a drive as file path, the XLS file can be opened without problems. Uninstalling the update fixes the error. So if the error occurs with you, you know where to look.

A workaround

Addendum: User Alber posted a workaround using the following registry entry.

Create a new DWORD32 Key

HKEY_CURRENT_USER\Software\Microsoft\Office\*X*\Excel\Security\ExtensionHardening=0x00000000(0)

In his case was *X* 15.0 for Excel 2013. After a restart the problem was gone for him. The problem is described in the article Force file extension to match file type. However, this only suppresses the error message – the bug is not fixed. I've reported the bug (and here) to Microsoft.

Addenum 2: Microsoft has now confirmed the bug in the support article for update KB5002242.

• Symptom
  After you install this update, you might encounter the following warning when you open Excel files from a network location if the file extension is correct:

  The file format and extension of %FILENAME% don't match. The file could be corrupted or unsafe. Unless you trust its source, don't open it. Do you want to open it anyways?

  Status
  Microsoft is researching this issue and will update this article when a fix is available.

  Workaround
  Copy the affected files to the desktop, and then open them in Excel.

Excel 2016: Macros break when saved

There is a second problem, which has nothing to do with the patchday, but was already reported in June 2022 by Swiss reader Jeannette Hügli. The topic has petered out and I delete the discussion area entries cyclically, so I'll pull the issue out here – maybe someone can confirm it. Jeanette writes:

Hello all.

I develop Excel applications and use an Office version 16 for this purpose. For a long time I had enabled the option to install the updates automatically. But on October 4, 2021 I noticed that the Excel applications broke after saving. Caused for the first time in version 2109 (build 14430.20234), since then I noticed it two more times (at best it happened more often, but I have now disabled automatic installation).

Normally the following happens: When saving, formulas that are not in English are changed to English and saved that way. When opening the file, they are translated back into the Office language (German for me).

And this happens then just sometimes no more. In the version above, the formulas were saved in German, which Excel then does not understand when opening and cannot open the file. The suggested repair causes all parts that contain formulas (formulas on the worksheet, conditional formatting, etc.) to be deleted.

The only salvage I have found so far is to go back to a file version that was saved under a previous version.

Research on this topic has not given me any clue as to what might be causing this behavior. Has anyone heard of this happening before? Does anyone have any ideas on how I could prevent this?

With many thanks

Jeannette

I haven't found anything on the internet about this error yet either. Maybe someone can confirm this.