https://bugs.documentfoundation.org/show_bug.cgi?id=173562
--- Comment #6 from [email protected] --- Independent confirmation, with stack evidence from crash dumps (no dumps attached, they contain process memory). Environment: Windows 11 26H2 (10.0.26300.9711), LibreOffice 26.2.x (the installed propertyhdl.dll is 26.2.6.3, replaced on 2026-10-04; the earlier crashes below happened with the previous 26.2.x build), x64, French locale. Symptom: explorer.exe crashes about every 5-6 days (19 Application Error 1000 events since 2026-07-06, 4 of them since 2026-10-19). Always exception 0xC0000374 in ntdll.dll (heap corruption fail-fast, same fault offset for a given ntdll build). Windows restarts the shell, the desktop icons get rearranged. No third-party antivirus shell extension involved (Windows Defender only). Evidence: I kept 8 minidumps (2026-09-27, 09-28, 09-29, 09-30, 10-19 x3, 10-24). In all 8, the faulting thread (ntdll heap-error frames on top) has 10 frames inside propertyhdl.dll, and it is the only non-Windows module among the first 80 stack frames. Return addresses, from the top of the stack: propertyhdl.dll+0xD947, +0x8F5B, +0x86DA, +0x6FF0, +0x3E94, +0x64DD, +0x3E80, +0x330F, +0x55908 (dumps before 2026-10-04) or +0x56918 (dumps after the DLL update), +0x3260. They are called from propsys.dll / SHCore.dll / windows.storage.dll, i.e. while the shell reads the property store of a file. The sequence is identical in the 8 dumps except for the 9th offset, which changed with the 2026-10-04 DLL update. Module identification, in case a matching PDB is available: propertyhdl.dll 26.2.6.3 x64, PE timestamp 2026-09-03 10:47:06 UTC, CodeView RSDS GUID 754E73C5-548F-4ACE-9940-71DDD36C78A0 age 1, pdb path E:\build\workdir\LinkTarget\Library\propertyhdl.pdb, SHA-256 0C2DBA17DECE4850213412038EE6CF1E6DB871BE9F79958521577321CF3DF065. Handler CLSID {AE424E85-F6DF-4910-A6A9-438797986431}, registered for 22 ODF extensions (.odt, .ods, .odp, ...). I have 9 ODF files in my Downloads folder; I do not know which one triggers it. This is consistent with the analysis in comment 2 (PropVariantClear on an uninitialized PROPVARIANT in CPropertyHdl::LoadProperties). I cannot map the offsets to source lines without symbols, so I cannot confirm the exact line. Workaround applied on 2026-10-24: I removed the 22 PropertyHandlers registrations that point to this CLSID (HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\PropertySystem\PropertyHandlers). Before that, I had one crash every 5-6 days; I will report back after about three weeks. I have not tested the patch from comment 4, but I can test a build if one is provided. -- You are receiving this mail because: You are the assignee for the bug.
