Resolved: Trending Issue: SharePoint worker process crashes with 0xC06D007E and 0xE0434352 exceptions

9 Comments

1. 

   Emiel
   On 10. February 2026 Permalink

   Hi Stefan,

   Thanks for the heads-up. I’m a bit confused about the timeline here. We currently have the January 2026 CU installed and everything is running smoothly, but we are planning to deploy the February updates to Dev soon.

   Since the February updates were just released today, was this “trending” issue actually a regression introduced in the January CU (or perhaps a specific Windows Update) that today’s release fixes? Knowing the root cause would really help us assess the urgency for our Production patching.

   Best regards,

   Emiel

   Reply
   1. 

      Emiel
      On 11. February 2026 Permalink

      Actually, looking at the error again, I realize this is likely the resolution for the regressions from the September updates. I was confused by the date of your post and because there was no reference to September. My apologies, and thanks for the great work!

      ​If I’m wrong, please let us know.

      Reply
      1. 

         Stefan Goßner
         On 11. February 2026 Permalink

         Hi Emiel,
         actually this is a fix for a race condition which was in the product at least since SharePoint 2010. But due to recent code changes the chance to hit this issue has significantly increased – which led to a significant number of customers being hit by the issue since roughly July 2025 CU.
         It was quite hard to identify the issue and even harder to get a reproducible repro to investigate it.
         Cheers,
         Stefan

         Reply
         1. 

            Tomas
            On 11. February 2026 Permalink

            Hello Stefan,
            We applied the July patch in SPSE, but we really got the problems after we applied the October patch. No other SPSE patches was applied in between those.
            So something other happened between July ans October.

            Regards
            Tomas

            Reply
            1. 

               Stefan Goßner
               On 11. February 2026 Permalink

               Hi Tomas,
               the fix for the issue was released yesterday:
               https://blog.stefan-gossner.com/2026/02/10/february-2026-cu-for-sharepoint-server-subscription-edition-is-available-for-download/
               Cheers,
               Stefan

2. 

   Leo
   On 12. February 2026 Permalink

   Hi Stefan,

   We are running a SharePoint 2016 on-premises farm and have been experiencing recurring Event ID 1000 crashes on our web applications since installing the October 2025 SharePoint 2016 CU.

   Yesterday, I deployed the SharePoint 2016 February CU in our DEV environment. After monitoring and comparing the new logs with historical event logs, I noticed that the following Event ID 1000 related to KERNELBASE.dll no longer appears:

   Faulting application name: w3wp.exe, version: 10.0.20348.1, time stamp: 0xcfdb13d8
   Faulting module name: KERNELBASE.dll, version: 10.0.20348.4294, time stamp: 0x689cd397
   Exception code: 0xc06d007e

   However, our SharePoint 2016 environment is still encountering Event ID 1000 crashes related to ntdll.dll, with details shown below:

   Faulting application name: w3wp.exe, version: 10.0.14393.0, time stamp: 0x57899b8a
   Faulting module name: ntdll.dll, version: 10.0.14393.8783, time stamp: 0x695f0e28
   Exception code: 0xc0000264
   Fault offset: 0x00000000000a5d70
   Faulting process id: 0x3f2c
   Faulting application start time: 0x01dc9b77db868857
   Faulting application path: C:\Windows\System32\inetsrv\w3wp.exe
   Faulting module path: C:\Windows\SYSTEM32\ntdll.dll
   Report Id: 8af72457-44b3-4ec4-a8c9-ddd0aa5cf980

   Immediately after this crash, an Event ID 8356 is logged, indicating that the web application pool has restarted:

   SharePoint booted.
   Process Name: [w3wp]
   App Pool: [SharePoint – ]

   From our investigation, it appears that the ntdll.dll Event ID 1000 crash is closely related to the previously observed KERNELBASE.dll crash. In our environment, both issues started to occur after installing the October 2025 SharePoint 2016 CU across DEV, QA, and PROD.

   Based on current observations, the February 2016 CU seems to have resolved the KERNELBASE.dll-related Event ID 1000, but the ntdll.dll-related Event ID 1000 crash still persists.

   Could you please help to confirm whether Microsoft has officially acknowledged or addressed the Event ID 1000 crash involving ntdll.dll, whether it is considered part of the same root cause as the KERNELBASE.dll issue, and when a fix is expected to be released?

   Best regards,
   Leo

   Reply
3. Microsoft Roadmap, messagecenter and blogs updates from 15-02-2026 - KbWorks - SharePoint and Teams Specialist
   3 weeks ago Permalink
4. 

   Chandu
   On 2. March 2026 Permalink

   Hi Stefan,

   Hope you are doing great.

   After installing the February SharePoint SE patches in our environment, we are still seeing the same .NET‑related crashes (0xe0434352 with KERNELBASE.dll). Your blog mentions that installing the February patch should resolve this issue, but we continue to experience the errors even after applying the Feb SE updates.

   In addition to the SharePoint worker processes, we are also seeing crashes in the following applications:

   • SensorLogonTask.exe (SCCM client component)
   • Microsoft.ServiceBus.MessageBroker.exe

   All of these processes fail with the same exception code 0xe0434352 and the faulting module KERNELBASE.dll.

   Example from our logs:
   Faulting application: SensorLogonTask.exe
   Faulting module: KERNELBASE.dll (10.0.20348.4648)
   Exception code: 0xe0434352

   Thanks.

   Reply
   1. 

      Stefan Goßner
      On 2. March 2026 Permalink

      Hi Chandu,
      this is then a different issue as these other processes are not loading the SharePoint dll where the fix was applied.
      Here I would advise to open a support case to get this investigated.
      Cheers,
      Stefan

      Reply