Microsoft Outlook Application Crash due to UCRTBASE.DLL

we are having a similar issue company wide, different build versions of Win 10, all on O365

tried all the usual fixes, outlook profile rebuild, office reinstall, office repair, windows updates, driver updates, disabling add-ins, nothing seems to resolve the issue

Faulting application name: OUTLOOK.EXE, version: 16.0.13628.20528, time stamp: 0x603fffa6

Faulting module name: ntdll.dll, version: 10.0.19041.844, time stamp: 0x60a6ca36

Exception code: 0xc0000409

Fault offset: 0x00000000000a1f10

Faulting process id: 0x4640

Faulting application start time: 0x01d7224b2b6b9dff

Faulting application path: C:\Program Files\Microsoft Office\root\Office16\OUTLOOK.EXE

Faulting module path: C:\WINDOWS\SYSTEM32\ntdll.dll

Report Id: c568c9cc-1b64-4ec9-910f-8dda67849304

Faulting package full name: 

Faulting package-relative application ID:

I'm also having the same crashes, but using Windows Defender rather than Sophos. 

Faulting application name: OUTLOOK.EXE, version: 16.0.13801.20294, time stamp: 0x6042d991

Faulting module name: ucrtbase.dll, version: 10.0.19041.789, time stamp: 0x2bd748bf

Exception code: 0xc0000005

Fault offset: 0x0000000000048b5e

Faulting process ID: 0x54e0

Faulting application start time: 0x01d71c03f5b46282

Faulting application path: C:\Program Files\Microsoft Office\root\Office16\OUTLOOK.EXE

Faulting module path: C:\WINDOWS\System32\ucrtbase.dll

Report ID: 0713bdc7-fcd5-4127-9001-3b05146231a0

Faulting package full name: 

Faulting package-relative application ID:

Thanks for the follow-up. I can confirm that the combination of (a) Sophos temporarily disabling the new "DCOM Lockdown" and (b) us removing the Exploit Mitigation global exclusion has not resulted in any further Outlook crashes within our environment.

• CP

I got an email from Sophos:

Our Development Teams have been able to identifythat the crashing stack was in our new "DCOM Lockdown" ExploitMitigation (part of regular application Lockdown), which we disabled on02/02/2021.

A fix for the crash in the DCOM Lockdown mitigation is currently being testedand will be part of the upcoming Sophos Central Intercept X cumulative hotfixto verify that the issue is actually resolved by the changes.

The hotfix is expected to be available by end of February. Once the hotfixversion was released, we will update you with this information.

In the meantime, if you have any additional questions or require furtherclarification regarding this matter, please do not hesitate to let me know.

I removed the global exclusion earlier this morning and will report back (good or bad).

Thank you.

-CP