Check docker
A panel docked next to the artwork, with the findings for the open document; double-clicking selects the shape. It changes nothing.
Deliverable: add-in with a WPF panelOcto for CorelDRAW · VSTA and add-ins
A docker next to the artwork, with code maintained as software.
CorelDRAW 2026 calls VSTA the successor to VBA: C# and VB.NET, compiled code, custom dockers. Octo builds the add-in, prepares and checks the developer's workstation and migrates VBA macros to C#, proving the result has not changed. Installing on the workstations and approving artwork stay with people.
VSTA editor requiresVS 2019Visual Studio 2019, according to the 2026 help
VS 2019 extended support2029until Apr 11, 2029, only on version 16.11
CVE-2025-298037.3high score; VSTA 2019 fixed in 2025
Sources6listed at the end of the page
01
What Octo does with VSTA and add-ins.
Six possible deliverables, drawn from the survey. All of them read before changing, all of them record the version and all of them go through a person before reaching the workstations.
Workstation diagnosis
Visual Studio 2019, VSTA 2019 and CorelDRAW read from Windows, compared against the help and the CVE-2025-29803 fix.
Deliverable: ambiente.json and pending items for ITVBA to C# migration
The same rule, translated without improving it, and a comparator that flags every difference between the outputs before the switch.
Deliverable: difference report at zeroVersioned package
DLL, XSLT and bookmark in a folder, zipped with the version and CorelDRAW year in the name, a contents list and sha256.
Deliverable: zip, sha256 and contents listMenu and workspace
AppUI.xslt and UserUI.xslt register the docker and the button without duplicating items when the workspace is reapplied.
Deliverable: reviewed XSLTSecurity and lifecycle
Visual Studio 2019 until 2029, VSTA with the 2025 fix, the add-in treated as software: review, sha256, logged installation.
Deliverable: version map by workstation
02
Eight arms, one checked add-in.
The same Octo cycle, applied to VSTA and add-ins. Each arm has a narrow role; people approve the artwork and install on the workstations.
-
Discovery
Maps what already exists
CorelDRAW, Visual Studio and VSTA versions by workstation, installed add-ins and CGSaddon and GMS projects in use.
-
Data
Pins down the output format
The inventory CSV and the docker's findings in the same format, so VBA and C# can be compared.
-
Security
Looks after the environment
Visual Studio 2019 lifecycle, CVE-2025-29803, package sha256 and logs without unnecessary personal data (LGPD).
-
Architecture
Chooses the path
VBA macro, VSTA project, add-in with a docker, or JavaScript for those who also use a Mac.
-
Development
Writes the add-in
C#, XAML and XSLT, with
try/finallyaround everything that changes CorelDRAW state and events unsubscribed on close. -
Review
Checks by content
Docker opened on known artwork, findings matching the CSV, package containing what it should. "It compiled" is not a check.
-
Release
Prepares the package
Versioned zip with sha256 and a contents list; installing on the workstations is up to IT.
-
Documentation
Records what holds
Versions by workstation, installed packages, who approved each change and how to roll back to the previous version.
Octo works on copies of the artwork and installs nothing without approval. It does not approve artwork or color proofs, does not change workstation security and does not choose a license for anyone.
03
Each task, its own path.
The criteria Octo uses to choose between VBA, VSTA, add-in and JavaScript.
| Task | Path | Note |
|---|---|---|
| Personal macro or simple batch | VBA | Start here; see the VBA and macros page |
| Docked panel with a list and buttons | Add-in with a WPF docker | Structure to be built on the installed version |
| Code with .NET libraries | VSTA or C# add-in | Compiles to a DLL |
| Shared .NET macro project | VSTA, CGSaddon file | Internal format not documented in any source read |
| Check the developer's workstation | Python + vswhere + registry | Read-only |
| Build and package | MSBuild + Bash + sha256sum | CorelDRAW version in the package name |
| Migrate VBA to C# | Translate without improving + compare CSV | Switch only with a zero-difference report |
| Run code when switching documents | Application event in the add-in | Unsubscribe when closing the docker |
| Automation on Mac too | JavaScript | VSTA and VBA are "Windows only" |
04
From macro to add-in maintained as software.
Three steps. Each one only makes sense after the previous one has shown results in your studio.
A proposal, not a promise
Checked environment
Octo shows what is on each workstation, without changing anything.
- Visual Studio, VSTA and CorelDRAW by workstation
- Pending CVE-2025-29803 items
- Add-ins and projects in use
Check docker
The audit findings next to the artwork, with a click through to the shape.
- Same rules as the VBA macro
- Package with sha256
- Test workstation before the team
Rules in C#
The audit migrated, compared and maintained with tests.
- Zero-difference report
- Version by workstation recorded
- Back to the previous version in minutes
05
Confirmed in a source.
Each point below has a source published by Corel, Microsoft, the open-source project or the responsible body. Object and method names are checked in the Object Browser of the installed version. The sources are in the next section.
4
points with a published source, each with its reference shown alongside.
- ConfirmedVSTA editor requires Visual Studio 2019
- "To use the VSTA Editor, you must first install Microsoft Visual Studio 2019 [...] and then reinstall Microsoft Visual Studio Tools for Applications 2019 from microsoft.com."Source: help.coreldraw.com, CorelDRAW 2026 Help, Macros
- ConfirmedVSTA projects in CGSaddon
- The Scripts docker creates projects "in the form of Global Macro Storage (GMS) files or Corel VSTA Projects (CGSaddon)".Source: help.coreldraw.com, CorelDRAW 2026 Help, Macros
- ConfirmedVisual Studio 2019 until Apr 11, 2029
- Mainstream support ended on Apr 10, 2024; extended support until Apr 11, 2029, on version 16.11.Source: learn.microsoft.com, Visual Studio 2019 lifecycle
- ConfirmedCVE-2025-29803, score 7.3
- Local elevation of privilege through an uncontrolled search path in VSTA and SQL Server Management Studio; VSTA 2019 released on Apr 9, 2025 includes the fix.Source: cve.org and microsoft.com, VSTA 2019 download
06
What Octo does and what stays with you.
Octo prepares everything, but it does not sign. The document of record stays with whoever is accountable for it.
Octo prepares
Surveys, calculates, organizes and generates the documents: files, PDFs, variable data spreadsheets, proofs and reports.
Deliverable: material ready to checkYour team checks
The client or the art director checks what Octo delivered before approving. If something doesn't add up, it goes back to Octo with the correction.
Step: review by the approverWho approves
Octo does not approve the artwork. Artwork carries no legal signature: approval of the artwork and the proof stays with the client or the art director.
Approval: client or art director
07
Sources.
Official CorelDRAW 2026 help, Corel and Microsoft pages and the CVE record, consulted on Oct 31, 2026.
- CorelDRAW 2026 Help, MacrosVSTA, Visual Studio 2019, CGSaddon
- Use macros and scripts to automate tasksVBA, VSTA and JavaScript
- Version comparisonVSTA "Windows only"
- Visual Studio Tools for Applications 2019Version 16.0, Apr 9, 2025
- Visual Studio 2019, lifecycleExtended until Apr 11, 2029
- CVE-2025-29803CVE record
Your docker, reviewed and checked.
The assessment starts by reading the workstations: what is installed, what is missing for VSTA to open and what the current audit already finds. You get the list and the questions only your team can answer, and you decide with it in hand.