Excel Embedded Images and OLE Objects: The Hidden Metadata in Pictures and Files Inside Your Workbooks

Two Categories of Embedded Object, Both Untouched

Excel treats embedded content as two separate things. Pictures — PNG, JPEG, GIF, BMP, TIFF files dragged into a sheet, pasted from clipboard, or inserted via Insert → Pictures — are stored byte-for-byte inside the XLSX package. OLE objects — Word documents, PDFs, Outlook .msg files, other XLSX files, even custom application files registered with the OS — are stored as full embedded files (or a wrapper around them) plus a thumbnail rendered for preview.

In neither case does Excel re-encode, re-render, or normalize the embedded content. The 12-megapixel JPEG you dropped on a quarterly review tab is the same JPEG, with the same EXIF block written by your phone’s camera firmware. The 80-page negotiation draft you embedded on the cover sheet is the entire .docx file, with its full revision tree and every commenter’s name. The XLSX is a transport container, not a sanitizer.

EXIF, IPTC, and XMP: What Phones and Cameras Wrote Into Your Picture

A JPEG taken on a modern phone is not just pixels. It carries up to four parallel metadata blocks: EXIF (camera settings), GPS (location), IPTC (caption, byline, copyright), and XMP (Adobe-style structured metadata, often added during editing). Most users do not know any of these exist; all four travel intact when the photo is dropped into Excel.

Every line in that block is a real disclosure. The GPS coordinates resolve in any mapping tool to a specific street address. The camera owner name and serial number identify the device that took the photo. The image description, written by the user during a sort or favorites pass, contains an internal warning that the recipient now reads. The creator tool reveals that the image was edited in Photoshop, and the history action count tells the recipient there were edits worth saving three times — a hint that something was retouched, painted out, or cleaned up.

The GPS Problem in Concrete Numbers

GPS leakage from embedded photos deserves to be called out separately because the consequence is so direct. A latitude/longitude pair with the typical six-decimal precision pins to roughly a 10-centimeter square. Embedded inside a workbook that ships to a counterparty, that translates to specific home addresses, hotel rooms, suppliers, dispute sites, and field locations.

Three categories of workbooks are particularly dangerous to share without sanitization:

OLE Objects: Whole Documents Riding Inside the Workbook

Insert → Object → Create from File → check “Display as icon” looks innocent. The user sees a small icon on the worksheet labeled with the filename. What Excel did under the hood is far more involved: the entire source file was read in, wrapped in a Compound File Binary container, written to xl/embeddings/oleObject1.bin, and a rendered preview image was generated and stored alongside it.

The wrapper is a thin one. Inside the .bin a tool like olefile or ssview finds the original document streams — for a Word doc, the entire docx package; for an Outlook message, the full .msg with attachments and recipients; for a PDF, the original PDF bytes. Each of those carries its own metadata tree:

Drawing XML: The Metadata Excel Wrote Itself

Beyond the embedded files, Excel writes its own descriptive metadata in xl/drawings/drawing1.xml for every shape, picture, and OLE object. Two fields here matter for disclosure: the shape’s name attribute (often the original filename) and the accessibility descr field (alt text, used by screen readers).

The shape name is whatever the source filename was when the picture was inserted — including parenthetical version markers like (1) that suggest a duplicate-rename pattern, descriptive suffixes the user added, and the file extension. The descr alt text is whatever the user (or Excel’s automatic captioning, if enabled) typed for accessibility. Both fields are visible to anyone who unzips the file and reads the drawing XML — and to many automated ingest pipelines that index alt text as caption text.

Recent versions of Excel offer auto-generated alt text via the cloud accessibility service. The auto-text is structurally informative (“A graph showing increasing revenue,” “A man in a red shirt next to a whiteboard with handwritten numbers”) and tells the recipient something about the picture even before they look at it — useful for accessibility, less useful when the recipient was not supposed to know what was on the whiteboard.

How This Goes Wrong in Practice

Four scenarios drawn from real patterns of disclosure:

How to Inspect Embedded Objects in an XLSX

A useful inspection enumerates every embedded artifact, dumps the metadata of each, and flags GPS coordinates and known-sensitive fields. Three practical approaches:

Method 1: Document Inspector (Insufficient on Its Own)

File → Info → Check for Issues → Inspect Document finds and offers to remove some image-related items, but it does not remove EXIF/GPS from the underlying media files, does not crack open OLE-embedded documents to inspect them, and treats the embedded objects as opaque blobs. Use it as a baseline pass, not a final answer.

Method 2: Unzip and Use ExifTool

Rename a copy of the XLSX to .zip, extract, and walk the xl/media/ and xl/embeddings/ trees:

Method 3: Automated Analysis

A dedicated metadata tool such as MetaData Analyzer enumerates every xl/media/ entry, runs an EXIF/IPTC/XMP pass on each, recursively extracts and inspects OLE embeddings, flags GPS coordinates and high-risk metadata fields, and produces a pre-share report — the only approach that scales beyond a handful of files.

How to Actually Remove Embedded-Object Metadata

There is no single button that removes all of it. Depending on what the file needs to preserve, combine the following:

Option A: Compress Pictures and Delete Cropped Areas

Option B: Strip EXIF and Re-Encode the Image Before Inserting

Option C: Replace OLE Embeddings With Sanitized PDF Snapshots

Option D: Programmatic Sanitization

For pipelines — DLP integrations, CI/CD exports, pre-send scanners — rewrite the package: replace each xl/media/ file with an EXIF-stripped copy, optionally remove xl/embeddings/ entirely, and clear the descr attributes in xl/drawings/. A minimal sketch:

Pre-Share Checklist for Workbooks With Embedded Content

Run through this checklist before releasing any workbook that contains pictures, screenshots, or embedded objects:

Organizational Recommendations

Image and OLE leakage is unusually concentrated in a handful of teams — sales, field operations, HR, legal, finance — and unusually invisible to the people creating the files. Organizations that manage the risk tend to combine several of the following practices:

Conclusion

An embedded image looks like a picture. A pasted document looks like an icon. Excel does not flatten either; it carries the original bytes intact, including every metadata block the source application wrote. A recipient with unzip and exiftool reads the GPS coordinates, the camera serial, the alt-text caption, the embedded Word doc’s tracked changes, and the BCC list of an embedded email.

The fix is mechanical — clean images before they enter the workbook, avoid embedding documents for convenience, run Compress Pictures with Delete cropped areas, and verify at the ZIP level. None of it happens by accident. Treat every workbook with media or embeddings as if it were a multi-format archive carrying the original metadata of every file inside it, because it is — until you deliberately remove it.