Microsoft Outlook Application Crash due to UCRTBASE.DLL

Anonymous
2020-12-07T17:43:25+00:00

Windows 10 Build 2004

Outlook crashes intermittently and generates the following Application Event Log error.

Event 1000, Application Error (11:06AM, 12/7/2020) Faulting application name: OUTLOOK.EXE, version: 16.0.13426.20308, time stamp: 0x5fc6ea9b Faulting module name: ucrtbase.dll, version: 10.0.19041.546, time stamp: 0x73123758 Exception code: 0xc0000409 Fault offset: 0x0009edbb Faulting process id: 0x41c0 Faulting application start time: 0x01d6ccaedccaa9fa Faulting application path: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE Faulting module path: C:\WINDOWS\System32\ucrtbase.dll Report Id: f8791f7b-faf7-452a-8ff2-7268662a6db2 Faulting package full name: Faulting package-relative application ID:

I have run SFC /SCANNOW

I have completely uninstalled and reinstalled Microsoft Office 365

Here are the properties of the failing file:

Windows for home | Windows 10 | Performance and system failures

Locked Question. This question was migrated from the Microsoft Support Community. You can vote on whether it's helpful, but you can't add comments or replies or follow the question.

0 comments

69 answers

Sort by: Most helpful
Most helpful Newest Oldest
  1. Anonymous
    2021-01-20T21:29:02+00:00

    T.Kennis:

    I tried the hotfix and it did not work for me.   I am currently testing Office without Sophos to see if I get the error.  Did Sophos give you any additional info?

    Today I ran several times my testscript starting 250 times a new e-mail message with various Sophos components individually turned OFF.

    When Exploit mitigation turned-OFF, I was able to run my test script 3 times in a row (= 750 emails) without a single crash of Outlook.

    After each test-run I restarted Outlook manually.

    When I turned the component back ON, Outlook crashed after about 20 emails.

    Again, tuned the component back OFF, my testscript ran succesfully again

    So, Sophos Exploit Mitigation seems te be the **** in this case.

    Is someone else able to proof this? 

    It looks like there is a Sophos Exploit mitigation hotfix available, which I will try.

    https://support.sophos.com/support/s/article/KB-000038477?language=en\_US

    WINEP-30574 Resolved and issue where CodeCave protection was causing applications to crash

    Was this answer helpful?

    0 comments
  2. Anonymous
    2021-01-19T21:43:24+00:00

    No they did not help. I will remove them as well.

    Hi! Have you had any other luck? We're using Sophos as well and while so far everyone isn't affected, we do have a handful of users who are affected and it's driving them nuts. The users who ae affected are on the latest January updates for O365. Has anyone tried rolling back to the December release?

    Was this answer helpful?

    0 comments
  3. Anonymous
    2021-01-19T08:28:45+00:00

    No they did not help. I will remove them as well.

    Was this answer helpful?

    0 comments
  4. Anonymous
    2021-01-18T21:02:54+00:00

    I had a reply from Sophos to find out which Sophos component causes the crashes of Outlook, by disabling each Sophos component individually instead of disabling Sophos as a whole.

    I wrote a simple VBA script using SendKeys() and some Sleep() commands to simulate:

    • create a new e-mail
    • write some lines in the body
    • discard the e-mail

    repeat that for 100 times.

    With all Sophos components enabled, I can reproduce a crash of Outlook within about 25 tries.

    With all Sophos components disabled, all 100 times are succesful.

    But with a single Sophos component disabled, (I already tested: Files, Ransomware Detection, Exploit mitigation and Malicious Behaviour Detection) a crash of Outlook can still be reproduced within 1000 tries.

    A few more Sophos components te go...

    Did the exceptions for OUTLOOK.EXE and UCRTBASE.DLL stop the crashes?  I added the exceptions this afternoon (18, Jan 2021) but I will remove them again if this has already proven to be ineffective.

    Was this answer helpful?

    0 comments
  5. Anonymous
    2021-01-18T15:23:37+00:00

    I had a reply from Sophos to find out which Sophos component causes the crashes of Outlook, by disabling each Sophos component individually instead of disabling Sophos as a whole.

    I wrote a simple VBA script using SendKeys() and some Sleep() commands to simulate:

    • create a new e-mail
    • write some lines in the body
    • discard the e-mail

    repeat that for 100 times.

    With all Sophos components enabled, I can reproduce a crash of Outlook within about 25 tries.

    With all Sophos components disabled, all 100 times are succesful.

    But with a single Sophos component disabled, (I already tested: Files, Ransomware Detection, Exploit mitigation and Malicious Behaviour Detection) a crash of Outlook can still be reproduced within 100 tries.

    A few more Sophos components te go...

    Was this answer helpful?

    0 comments