What Is an OLE Object? — How Embedding and Linking Work and the Pitfalls in Business Documents

“I double-clicked a table in a Word specification, and the menu turned into Excel’s.” That is what happens when the table is placed in the document not as a plain picture but as an OLE object.

OLE stands for Object Linking and Embedding. It integrates document data created by another application into a host document, either by embedding or by linking. Technically, the entity is a COM object that can be embedded in or linked to a document.¹²

The starting point for understanding it is the question “where is the actual data?” Once that is clear, you can sort out why documents grow large, why links break when a server is moved, and why a table can be visible yet not editable.

This article is for IT staff at small and mid-sized companies and for business application developers. It starts by comparing embedding and linking, then moves on to everyday operations, symptom-by-symptom fixes, and the caveats for Access and security. The internals such as COM and Structured Storage are collected in Section 7, and the decisions about future operation and design in Section 8.

1. The Bottom Line First: Embedding Is a “Copy Inside the Document,” Linking Is a “Reference to Another Location”

The difference between embedding and linking is where the actual data is stored. Portability, file size, and how updates happen all follow from that difference.³

Embedding suits cases where you want the document to be independent of the original file. Linking suits cases where several documents share the same data and you want changes to the original reflected. Link updates, however, are not necessarily automatic. Whether they are automatic or manual is decided by a setting on the document side.⁴⁵⁶

flowchart TB
    accTitle: The difference between embedding and linking
    accDescr: Embedding stores the actual data in its entirety inside the host document, which makes the document self-contained but larger, whereas linking places only a reference, the update setting and usually presentation information in the document while the actual data stays in the link source file, so the document stays small and changes to the source can be reflected according to the link update setting (automatic or manual)
    doc["Host document (Word document, etc.)"] --> emb["Embedding: stores the data itself"]
    doc --> lnk["Linking: reference, settings and (usually) presentation info"]
    emb -.-> self["Self-contained but larger"]
    lnk --> src["Link source file (the data lives here)"]
    src -.-> upd["Source changes can be reflected (depends on setting)"]

Figure 1: Whether the document holds the data itself or references data in another location. This difference determines the properties of size, updating, and handover.

“The data is inside the document” and “it can be edited on any PC” are two different things. Also, if a presentation cache remains, only the last appearance may be displayed even when the originating application or the link source is unavailable. Separating “it is visible,” “it can be edited,” and “it is up to date” is the basis of triage.⁷⁸

In the diagram a solid line marks a relation that always holds and a dashed line marks a conditional one (the conditions are given per relation on the detail page). The full list of relations (25 in total, with evidence and certainty) and the definitions of the main concepts are collected on the knowledge map detail page (in Japanese). Data: JSON-LD / Turtle

2. Where OLE Objects Are Used and How They Get into a Document

2.1 You Meet Them in Word, Excel, Access, and Old Business Documents

OLE has supported the Windows document culture since the 1990s. The mechanism is still in service today, but for practical purposes it is better seen not as a technology to adopt actively in new designs but as one you encounter inside existing documents and databases.

Databases that have stored employee photos or product images in Access OLE Object fields are another typical existing asset. This use has a bloat problem, and Section 5 covers the migration decision.⁹

2.2 “Insert Object” and “Paste Special”

Insert Object lets you choose between creating a new object and creating one from an existing file. There is also a “Display as icon” display option.

Paste Special lets you choose the data format and, in addition, whether to embed or to link. The entries listed there as “… Object” are the options that paste as OLE. Both the data stored and the way it is edited afterward differ from pasting a plain picture.¹⁰¹¹

These two correspond to OLE’s standard dialogs, Insert Object and Paste Special, and MFC provides classes for displaying them. The difference between the path that creates objects from copy and paste or drag and drop and the path that creates them directly from a registered class or a file is explained in Section 7.1.¹⁰¹²

3. What Happens When You Double-Click

3.1 The Host Is the “Container,” the App That Does the Editing Is the “Server”

When a Word document contains an Excel table, Word is the OLE container that hosts it, and Excel, which handles editing the table, is the OLE server. A document that handles data from several applications inside a single document is called an OLE compound document.¹²

Word does not implement all of Excel’s editing features. The mechanism uses the originating application’s features when you operate on the object. That is why editing requires the originating application even when the data itself is stored inside the document.

3.2 A Double-Click Runs the “Primary Verb” Chosen by the Object

An OLE object defines the operations that can be performed on it as verbs: Edit for a table, Play for audio, and so on.

The host application responds to a double-click or a similar action by calling IOleObject::DoVerb. What the default operation, the primary verb (OLEIVERB_PRIMARY), does is decided by the object, not by the host. DoVerb automatically starts the OLE server application and performs the operation appropriate to that object. A double-click does not always mean Edit.¹³

3.3 When Editing Happens Inside Word and When a Separate Window Opens

If both the embedded object and the host support In-Place Activation, the object can be edited inside the host’s window. The menu bar is replaced by a composite menu bar that merges the menus of the container and the server. This is the mechanism by which Excel’s editing menus appear inside Word. Clicking outside the object deactivates it and restores the original menus.¹⁴

sequenceDiagram
    accTitle: From double-click to In-Place Activation
    accDescr: The host application responds to a double-click by executing the primary verb through IOleObject's DoVerb, OLE starts the server application, and if both the host and the server support In-Place Activation the embedded object is edited inside the host's window with merged menus and a click outside deactivates it and restores the original menus (if either does not support it, editing happens in a separate window)
    participant U as User
    participant C as Host app (Word, etc.)
    participant S as OLE / server app
    U->>C: Double-click the embedded object
    C->>S: Execute the primary verb via DoVerb
    alt Both support In-Place Activation
        S->>C: Start the server, merge the menus
        U->>C: Edit in place
        U->>C: Click outside the object
        C->>S: Deactivate, restore the original menus
    else Either side does not support it
        S->>C: Edit in a separate window
    end

Figure 2: Editing an embedded object in place requires support from both the container and the server. Without it, editing happens in a separate window.

How an object opens depends on the type of object, the verb executed, and what the applications support.

In-Place Activation is a mechanism that presupposes embedding; it is not used for links. Implementing it is also optional for both the container and the server. The mere fact that “the same document opens differently” is not grounds for calling it a malfunction.¹¹⁴¹³

4. Triage by Symptom: Not Updating, Too Large, Will Not Open

4.1 The Table Is Visible, but Changes to the Link Source Are Not Reflected

Check the location of the link source and the link’s update method. What a link holds on the document side is not the data itself but management information such as the link source’s name and location and the update setting, plus, usually, a presentation cache.¹⁵⁵

The job of tracking down the link source belongs to a COM component called a moniker. When a file server move, a folder rename, a change to a share path, deletion of the original file, or the like makes the new location impossible to trace, resolving the link fails. That is a broken link.

If a presentation cache was saved, the old table remains in the document. A table being displayed is not evidence that the link is healthy. If the object was created with a setting that keeps no cache, not even that last appearance remains.⁷⁸

The fix is to repoint the link source path to the new location from the document’s Edit Links dialog. If the path is correct but the object does not update, it may simply be set to manual update, so check the update method as well. When changes to the link source are reflected depends on the automatic or manual update setting.⁶

If there are many documents that rely heavily on links, include an inventory before the move and the link updates after the move in the file server migration plan. Plan a bulk update as well where possible. If you notice only after the move, you end up hunting, document by document, for the link sources that former staff used.

4.2 A Word or Excel Document Is Abnormally Large

Check whether re-editing is needed, and reconsider whether the document needs to hold the data itself. Embedding duplicates the data and stores it inside the document, so the document is generally larger than when the same content is linked. A presentation cache is usually stored too, so the document does not necessarily contain only the data used for editing.⁴⁷

When a report with many embedded tables grows large and takes a long time to open, suspect this structure. Choose the remedy to match how the data is used.

Bear in mind, however, that switching to links to reduce size adds the responsibility of managing the link sources. In documents that are distributed, the reference breaks easily, so a blanket “turn every embedding into a link” is not the right fix.

4.3 Double-Clicking Does Not Open or Edit the Object

First, check whether the originating application for that object is also present on the current PC. The self-contained nature of embedding is about where the data is stored; the editing features are not inside the document.

If the originating application is absent, only the display can be used, provided a presentation cache was saved. Cached presentation data is designed to be available from the container even when the server application is not running or is unavailable.⁷

If the object was pasted with “Display as icon,” however, you can see the icon but not the content. For an object that holds no cache at all, not even the last appearance remains. Whether a cache exists depends on the OLERENDER value specified at creation time.⁸

If the originating application is present and the object still will not open, triage in this order.

1. Check version compatibility of the application. Converting the type may be necessary, and OLE has a standard dialog for conversion.
2. Check for a missing or damaged COM class registration (CLSID). Repairing the registration may require reinstalling the application or similar.
3. Check for blocking by security settings, and corruption on the document side.¹⁰

For documents of unknown origin, do not prioritize getting them to open; adopt the practice of not activating the object. The security handling is explained in Section 6.

5. In Access, Separate “Just Storing” from “Needing OLE Behavior”

5.1 Images in an OLE Object Field Tend to Bloat the Database

Access’s OLE Object data type is a field type for embedding or linking objects such as Excel spreadsheets, Word documents, drawings, and sounds in a table. Its upper limit is about 1 GB.⁹

Using this type only to store employee photos or product images makes storage efficiency a problem. Microsoft explains that the Attachment data type is more flexible than the OLE Object data type and uses storage more efficiently because it does not create a bitmap image of the original file.⁹

Switching to the Attachment type does not, however, remove the size limits.

These are constraints of the Access Attachment type. They apply to a different subject than the roughly 1 GB limit of the OLE Object type.¹⁶

5.2 For Storage Alone, Use the Attachment Type or a Folder with Path Management

In a new design that only needs to store images or files, there is no need to choose the OLE Object type. Consider the Attachment type, or a design that places the files in a folder and keeps only the paths in the database. For existing databases too, these two are the migration targets.

It is a different matter if you need OLE-specific behavior such as linking or activation. In that case, make the decision with keeping the status quo as one of the options. Rather than “replace it immediately because it is the OLE Object type,” first separate whether it is mere storage or whether it needs to work as an object.⁹¹⁶

6. Security: Treat Ordinary Embedding and OLE Packages Differently

6.1 A Document Becomes an Entry Point for Running Another Application

With OLE, an object from another application is brought into a document and run on the PC of whoever opens it. This structure is also a delivery vehicle for attackers.

In fact, CVE-2014-4114, a vulnerability that executes arbitrary code through PowerPoint files and the like containing a crafted OLE object, was used in targeted attacks. Because Office formats and others that can hold OLE objects can become attack vectors, “I only meant to read the document” turns into an entry point for execution.¹⁷

6.2 Block OLE Package Activation Organization-Wide

OLE packages (Object Packager) deserve particular attention. They are an old mechanism that wraps an arbitrary file into a document as an OLE object, and they can hold executable files too. A remote code execution vulnerability concerning Object Packager has also been published.¹⁸

For this reason, prohibiting OLE package activation in Word, Excel, and PowerPoint through registry settings is a hardening measure. Microsoft’s guide aligned with the Australian government’s Essential Eight shows the procedure for distributing a PowerShell script for these settings to the organization through Intune.¹⁹

Split the operating practice into three points.

• Do not open, and do not let others open, objects in documents of unknown origin. Treat activation as an operation of the same weight as opening another file.
• Block OLE package activation organization-wide. It is almost never needed in normal work, so do not rely on individual caution alone.
• Do not impose a blanket ban that extends to ordinary embedding and linking in internal documents. Judge the risk of packages and crafted documents separately from existing business use.

The conclusion of this article is not “ban OLE altogether.” Rather than stopping work by uniformly banning even ordinary embedded Excel tables, the point is to focus on objects of unknown origin and on OLE packages.

7. Internals: The Roles of COM, Structured Storage, and Monikers

From here on, the explanation moves closer to implementation, as needed for maintaining business applications and investigating document assets. It maps the symptoms so far to “which mechanism is responsible.”

7.1 The Three Foundations of OLE Compound Documents

OLE compound documents rest on COM, Structured Storage, and Uniform Data Transfer. In addition to COM’s IUnknown, an object exposes compound-document-specific interfaces such as IOleObject and IViewObject2. A linked object additionally implements IOleLink.²

On the data transfer path, the OLE server offers its data through IDataObject and tells the container, through dedicated clipboard formats, whether it can be pasted as an embedding or as a link. This is what leads to the options in Paste Special.¹²

However, not every creation operation goes through IDataObject. Creating a new object from Insert Object, or creating one from an existing file, is a separate path that creates the object directly from a registered class or a file. The mechanics of the clipboard and drag and drop themselves are covered in “How the Clipboard and Drag & Drop Work”.

7.2 Structured Storage Is “a File System Inside a Single File”

Structured Storage creates, inside a single file, a hierarchy of storages (IStorage), which correspond to directories, and streams (IStream), which correspond to files. Substorages and streams can be nested under the root storage.²⁰

The standard implementation provided by COM is compound files. It is a single-file format that can be handled independently of file systems such as FAT and NTFS, and the format itself is published as MS-CFB (Compound File Binary File Format).²¹²²

The container provides the place where the object is saved. An object that persists through IPersistStorage writes its data to the IStorage it is handed. An implementation that uses IPersistStream saves to an IStream instead.²

flowchart TB
    accTitle: Internal structure of a compound file
    accDescr: A compound file has, under its root storage, a hierarchy of storages that correspond to directories and streams that correspond to files, embedded objects that persist through IPersistStorage are saved in substorages and objects that persist through IPersistStream in streams, an embedded object's storage can carry a CLSID that identifies the originating application (it may also be empty), the presentation cache stream is usually saved but may be absent depending on the setting at creation time, and the whole works as a file system inside a single file
    root["Root storage (document body)"] --> s0["Stream: body data"]
    root --> st1["Storage: embedding (IPersistStorage)"]
    st1 --> s1["Stream: object data"]
    st1 --> s2["Stream: presentation cache (usual)"]
    st1 -.-> cls["CLSID can identify the originator (optional)"]
    root -.-> s3["Stream: IPersistStream persistence"]

Figure 3: A hierarchy is built inside the document, and the object saves its own data. Distinguish persistence through a storage from persistence through a stream.

A directory entry can carry a CLSID that identifies the object’s originating application. If the embedding’s storage contains a CLSID, it is possible to determine which application should open the object. The CLSID may be empty, however, and the presentation cache may also be absent depending on the setting at creation time.²²⁸

7.3 Moving to .docx Did Not Make the OLE Storage Format Disappear

In the old Office formats .doc / .xls, the file itself is a compound file. The document body is stored as streams, and embedded objects as substorages.

The current .docx / .xlsx are ZIP-based Open XML formats, but the binaries of legacy OLE embeddings, oleObject*.bin, are still stored in the compound file format. On the other hand, when new Office documents are embedded in each other, a file such as an .xlsx may sit inside the ZIP as is.²²

In other words, the compound file is not merely “an old document format”; it survives inside current documents as a nested storage format.

7.4 Monikers Track the Link’s Location; the Link Settings Govern Updates

A moniker is a COM component that expresses an object’s location as a name and resolves it when needed. This resolution is called binding. A linked object uses monikers to manage naming, tracking, and activation of the link source.¹⁵

IOleLink is the interface that provides the container with link-source management. Its presence or absence lets the container tell an embedding from a link. Even when a document containing a link is saved, the link’s data itself is saved to the link source. What remains in the document is the link’s own management information, such as its name and location and the update setting, and usually a presentation cache.¹⁵

This division of labor is what leads to Section 4.1’s “the table is visible but does not update.” If resolving the link source fails, the data cannot be reached, and even if it can be reached, a link set to manual update is not updated automatically. Investigating location resolution, the update setting, and the cached display separately lets you sort out the cause.⁶⁷

8. How to Live with OLE Today: Add No New Dependencies, Know the Existing Ones

The basic policy is to avoid relying on OLE embedding in new designs, and to handle existing assets by “keeping an environment that can open them” and by “taking inventory.” Whether to keep using it is decided case by case.

The Access and security decisions each correspond to Microsoft’s own material as well.⁹¹⁹

For long-term retention, the environment that can open the data is part of the asset, not just the data. Generational changes in applications and changes in the OS erode the assumption that the originating application is available. Beyond keeping PDF versions of important documents, measures such as maintaining an environment that can open them in a virtual machine are needed.

The OLE mechanism keeps working as long as Windows keeps preserving backward compatibility. Whether an individual object opens, however, depends on whether the originating application still exists. If that assumption is secured, there is no need to rush to eliminate everything.

The inventory should identify three things: the servers that hold link sources, the documents that contain embeddings, and the databases that use the OLE Object type. Once these dependencies are known, migrations, hardening, and conversions can be built into a plan.

9. Summary

An OLE object is a COM object for handling another application’s document data as an embedding or a link. Embedding stores the data inside the document; linking references data in another location. Start by getting that difference straight.²⁴⁵

Next, think about display, editing, and updating separately. Even if a presentation cache remains, the object cannot be edited without the originating application, and it cannot be updated if the link source cannot be traced. How it opens on a double-click also varies with the type of object, the verb, and support for In-Place Activation.

Add no new dependencies in new workflows, and maintain existing documents by knowing the environment that can open them and where their references point. For mere image and file storage in Access, use the Attachment type or path management, and block OLE package activation organization-wide.

COM, the clipboard and drag and drop, and the compound documents in this article are different facets of the word OLE. Separating the roles of component infrastructure, data transfer, and integration into documents makes it easier to follow what is happening inside old business assets.

Related Articles

• What Are COM / ActiveX / OCX? - The Differences and Relationships Explained
• How the Clipboard and Drag & Drop Work — Handling OLE Data Transfer Correctly in Business Apps
• COM STA/MTA Fundamentals - Threading Models and How to Avoid Hangs
• Why EXCEL.EXE Processes Remain After C# Excel COM Automation — Reference Release Patterns and the Replacement Decision
• How to Handle ActiveX / OCX Today - A Keep / Wrap / Replace Decision Table
• Extending the Life of and Migrating VB6 / Access Business Apps — A Decision Table for Keep, Wrap, or Replace

Related Consulting Areas

KomuraSoft LLC handles the investigation and migration of legacy document and database assets involving OLE and COM (moving away from Access’s OLE Object type, taking inventory of embedded documents and converting them to PDF, bulk handling of broken links), the maintenance and modification of business applications that include COM components, and the design of Office-integrated applications. You are welcome to consult us even from the stage of “I have no idea what happens when I double-click this document.”

• Windows Application Development
• COM Component Development
• Technical Consulting & Design Review
• Contact

References

Related Articles

Recent articles sharing the same tags. Deepen your understanding with closely related topics.

Related Topics

These topic pages place the article in a broader service and decision context.

Where This Topic Connects

This article connects naturally to the following service pages.

Frequently Asked Questions

Common questions about the topic of this article.

What is the difference between embedding and linking?

The difference is where the actual data is kept. Embedding stores the object's data in its entirety inside the host document. The document becomes independent of the original file, so handing it to another PC never breaks a reference (although editing requires the originating application on the receiving PC as well; without it, you can only view the presentation cache if one was saved, and an object displayed as an icon cannot be inspected at all). In exchange, the file grows larger, and changes to the original data are not reflected in the document. Linking places only a reference (the link source's name and location), the update setting, and presentation information in the document, while the actual data stays in the link source file. The document is small and changes to the link source can be reflected in it (automatically or manually, depending on the link's update setting), but if the link source is moved or renamed so that it can no longer be traced, the link breaks. You choose which way to paste in the Paste Special or Insert Object dialog.

Why can't I open or edit an embedded object in a document by double-clicking it?

The most common cause is that the originating application for that object is not installed on the current PC. Editing an embedded object starts the originating application (the OLE server), so without it you can only view the presentation cache, if one was saved, and if the object is displayed as an icon you cannot even see its content. If the originating application is present but the object still will not open, suspect these in order: a case where a version difference requires conversion, a missing or damaged COM class registration (CLSID) that a reinstall or similar can fix, corruption on the document side, and a case where security settings block activation.

Why do Word and Excel files become abnormally large with embedded objects?

Because embedding is a method that stores a duplicate of the actual data inside the document. A document that holds an object as an embedding is generally larger than one that holds the same object as a link. In addition, the document usually stores a presentation cache alongside the data used for editing (whether a cache is kept is decided by the setting at creation time). To make the file smaller, the options are to link instead of embed, to paste as a picture (accepting that re-editing is not needed), or to share the original file separately and put only a link or a picture in the document. Links, however, require managing the link source, so they are not suited to documents that are distributed.

After we moved our file server, the linked objects in our documents stopped updating. Why?

Because what a linked object holds inside the document is not the actual data but only the link source's name and location information (a moniker), the update setting, and a presentation cache. When the link source's location changes through a file server move, a folder rename, a change to a share path, or the like, and the new location can no longer be traced, resolving the link fails and only the old presentation cache remains in the document (for an object created with a setting that saves no cache, not even that display remains). To repair it, repoint the link source path to the new location from Edit Links in each document. Note that if the path is correct but the object still does not update, the link may simply be set to manual update rather than broken, so check the update method setting as well. If there are many documents, take an inventory of the documents that contain links before the move, and if possible build a bulk link update into the plan.

I have heard that OLE objects are a security risk. Is it all right to keep using them?

OLE's structure, which brings another application's object into a document and executes it on the side that opens it, is a convenient delivery vehicle for attackers too, and arbitrary code execution vulnerabilities through crafted OLE objects have been used in real targeted attacks. OLE packages, which can wrap an arbitrary file, are especially dangerous, and public guidelines such as the Australian government's Essential Eight recommend prohibiting OLE package activation in Word, Excel, and PowerPoint through registry settings. There is no need for a blanket ban that extends to ordinary embedding and linking in internal documents; the realistic middle ground is not to open objects in documents of unknown origin and to block OLE package activation organization-wide.

Author Profile

Profile page for the article author.

Go Komura

Representative of KomuraSoft LLC

Focused on Windows software development, technical consulting, and investigations into failures that are difficult to reproduce.