2

We're seeing multiple clients of ours experiencing outlook crashing after upgrading Outlook to any of the November 9th updates across at least two of the update channels (Monthly Enterprise 2209 (15629.20258) and Semi-Annual Enterprise: 2202 (14931.20806)). We're still in the investigation phase of trying to determine root cause, but we have some data at this point.

The EventViewer error is:

Faulting application name: OUTLOOK.EXE, version: 16.0.15629.20258, time stamp: 0x63603097 Faulting module name: ucrtbase.dll, version: 10.0.19041.789, time stamp: 0x2bd748bf

Sometimes it is ntdll.dll instead of ucrtbase.dll

We've gotten a couple crash dumps from one of our customers and the line that throws exceptions are different, but they're also rather innocent. In one place we do this:

Dim propertyAccessor As Microsoft.Office.Interop.Outlook.PropertyAccessor = mail.PropertyAccessor

and the other:

Dim mail As Microsoft.Office.Interop.Outlook.MailItem = TryCast(item, Microsoft.Office.Interop.Outlook._MailItem)

We use Add-in Express and in both those cases, the callstack shows our code being called from:

AddinExpress.MSO.2005.dll!AddinExpress.MSO.ADXOutlookAppEvents.DoExplorerSelectionChange(object explorer) AddinExpress.MSO.2005.dll!AddinExpress.MSO.ADXAddinModule.OlExplorerEvents_10_SinkHelper.AddinExpress.MSO.IExplorerEvents_10.SelectionChange()

Finally, the exception in the dump files from the customer is:

Unhandled exception at 0x00007FFF720BC67F (ntdll.dll) in OUTLOOK.EXE.7468.dmp: Indirect call guard check detected invalid control transfer.

Does anyone know how a variable assignment or a TryCast could trigger a Control Flow Exception? Or any steps we could do to get more information about the root cause?

Eugene Astafiev
  • 47,483
  • 3
  • 24
  • 45
Corith Malin
  • 1,505
  • 10
  • 18
  • Have you tried to create a crash dump using ProcDump.exe? Run `procdump.exe -e -ma -o -w outlook.exe` – Dmitry Streblechenko Dec 20 '22 at 23:26
  • We did create crash dumps (that's how we got the Control Flow Guard Exception), but we used `.\procdump.exe -t -e outlook.exe` to generate them as they came from customers concerned about PII leakage, so we didn't want to use the `-ma` option. Do you think that would give us vital new data to include the `-ma` flag? – Corith Malin Dec 21 '22 at 08:49
  • What do you see on the call stack leading to the crash? – Dmitry Streblechenko Dec 21 '22 at 15:20

1 Answers1

0

Just wanted to follow up on this as I hate un-followed up questions on StackOverflow. :) The problem "went away" over time. I'm assuming it was addressed in an Outlook update - but I haven't been able to track down any mention of it in the release notes. We did work with a Microsoft Support Engineer on it, but it was first line support so not much came out of it.

Corith Malin
  • 1,505
  • 10
  • 18