Microsoft Outlook Application Crash due to UCRTBASE.DLL

The only consistency we've been able to nail down is that the faulting module is always that DLL, which is a software component of Microsoft Visual C++. The rest has truly been a head scratcher because it only affects a subset of our users, Office and Windows versions seemingly do not matter, and we have honestly tried just about every Google solution out there:

• Outlook in Safe Mode
• Roll back Office to known working version
• Roll back Windows to known working version
• Deployment Image Servicing and Management (DISM)
• System File Checker (SFC)
• Disable hardware acceleration
• Recreate Outlook OST file
• Recreate Outlook profile
• Recreate Windows profile
• Reformat computer

We finally bit the bullet and reached out to Microsoft and are actively working with them. Depending on the results there, I will make sure to update everyone here and all of the other message boards I've posted on.

Thank you.

we are having a similar issue company wide, different build versions of Win 10, all on O365

tried all the usual fixes, outlook profile rebuild, office reinstall, office repair, windows updates, driver updates, disabling add-ins, nothing seems to resolve the issue

Faulting application name: OUTLOOK.EXE, version: 16.0.13628.20528, time stamp: 0x603fffa6

Faulting module name: ntdll.dll, version: 10.0.19041.844, time stamp: 0x60a6ca36

Exception code: 0xc0000409

Fault offset: 0x00000000000a1f10

Faulting process id: 0x4640

Faulting application start time: 0x01d7224b2b6b9dff

Faulting application path: C:\Program Files\Microsoft Office\root\Office16\OUTLOOK.EXE

Faulting module path: C:\WINDOWS\SYSTEM32\ntdll.dll

Report Id: c568c9cc-1b64-4ec9-910f-8dda67849304

Faulting package full name: 

Faulting package-relative application ID:

Today I ran several times my testscript starting 250 times a new e-mail message with various Sophos components individually turned OFF.

When Exploit mitigation turned-OFF, I was able to run my test script 3 times in a row (= 750 emails) without a single crash of Outlook.

After each test-run I restarted Outlook manually.

When I turned the component back ON, Outlook crashed after about 20 emails.

Again, tuned the component back OFF, my testscript ran succesfully again

So, Sophos Exploit Mitigation seems te be the **** in this case.

Is someone else able to proof this? 

It looks like there is a Sophos Exploit mitigation hotfix available, which I will try.

https://support.sophos.com/support/s/article/KB-000038477?language=en\_US

We have applied the Outlook exclusion, and no crashes.

We have many clients and this only affects one, they work in Insurance and run Act! and Acturis.  They are our only client running those, anyone else using either?  They both have plugins to Outlook but as the crashes happen in safemode I had discounted 3rd party addins.

None of my clients use those applications.   I think it is just something with the Sophos Mitigation component messing with Outlook.

As a next level test I have enabled Exploit Mitigation but turned off all the sub-components for Mitigation on Microsoft Outlook.  So far there have been no crashes. So it looks like it is one of these sub-components causing the crash.

I apologize for the delay. I've listed the installed versions from two of our troubled workstations below. Unfortunately, the exact version that you mentioned isn't listed.

SYSTEM #1

Microsoft Visual C++ 2005 Redistributable 8.0.61001

Microsoft Visual C++ 2005 Redistributable 8.0.59193

Microsoft Visual C++ 2005 Redistributable (x64) 8.0.61000

Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17

Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161

Microsoft Visual C++ 2008 Redistributable – x86 9.0.30729.17

Microsoft Visual C++ 2008 Redistributable – x86 9.0.30729.4148

Microsoft Visual C++ 2008 Redistributable – x86 9.0.30729.6161

Microsoft Visual C++ 2010 x64 Redistributable – 10.0.40219

Microsoft Visual C++ 2010 x86 Redistributable – 10.0.40219

Microsoft Visual C++ 2012 Redistributable (x64) – 11.0.50727

Microsoft Visual C++ 2012 Redistributable (x64) – 11.0.61030

Microsoft Visual C++ 2012 Redistributable (x86) – 11.0.50727

Microsoft Visual C++ 2012 Redistributable (x86) – 11.0.61030

Microsoft Visual C++ 2013 Redistributable (x64) – 12.0.30501

Microsoft Visual C++ 2013 Redistributable (x86) – 12.0.30501

Microsoft Visual C++ 2015 Redistributable (x64) – 14.0.24123

Microsoft Visual C++ 2015 Redistributable (x86) – 14.0.24123

SYSTEM #2

Microsoft Visual C++ 2010 x86 Redistributable – 10.0.40219

Microsoft Visual C++ 2012 Redistributable (x86) – 11.0.60610

Microsoft Visual C++ 2013 Redistributable (x86) – 12.0.30501

Microsoft Visual C++ 2015 Redistributable (x86) – 14.0.23026

Last week, I went so far as to reformat one troubled system and recreate the local profile on another (i.e., straw grasping exercise). Surprisingly, the reformatted PC is worse than before and the jury is still out on the other, but I don't hold out much hope due to the results of the former.

I, too, am coming to a similar conclusion. The DLL (ucrtbase.dll) is part of the Microsoft Visual C++ redistributable, so it's just a matter of determining if its an update to that causing issues and/or an update to Office 2016 and/or Windows that isn't jiving well.

Thank you.