Skip to main content

ShellHost.exe System Error — "Overrun of a Stack-Based Buffer" Popup at Logon

Steve Ku
  • Created:
  • Updated:

⚠️ Error Message

ShellHost.exe - System Error
The system detected an overrun of a stack-based buffer in this application. This could allow a malicious user to gain control of this application.

Despite the wording, this is not indicative of memory corruption. Crash dumps collected across multiple occurrences show the same cause: at logon, ShellHost.exe (the Windows 11 Control Center) attempts to load its WinUI framework package, that load fails with a Windows app-packaging error (0x80073D54), and Windows' error handler raises the generic "overrun of a stack-based buffer" fail-fast dialog.

In other words, the user's per-user WinUI / app-package registration isn't in a loadable state at the moment the shell starts, so ShellHost can't initialize and Windows surfaces it as this popup.

ℹ️ Why It's Intermittent
ShellHost usually recovers on its own. In most logons the framework package resolves on a retry and the shell finishes loading normally, so there's no visible symptom. The popup only appears on the minority of logons where that load fails and isn't handled internally — which is why users can log in cleanly and also see the error intermittently.

Interim Workaround — Auto-Dismiss the Popup at Logon

This is a temporary measure that keeps the popup from interrupting logon. It does not change the underlying cause, which we are still working. A small script runs from a dedicated ProfileUnity configuration set to execute before your main config; it watches for the ShellHost popup, closes it as soon as it appears, and stops on its own after 5 minutes.

  1. Create a scripts directory on your ProfileUnity share, for example \\Domain\NETLOGON\profileunity\scripts.
  2. Copy the closer script (close_shellhost_popup.ps1) into that directory.
  3. Import the prep configuration. In the management console go to Configuration Management, click the red Import button, and import the provided Configuration-000 - Prep.json file.
  4. Edit the imported config. Rename it to 000 - Prep, then in the Application Launcher module verify the script path points to the location from step 1. Update and deploy.
  5. Confirm it's running. Configs execute in numerical/alphabetical order, so 000 - Prep runs first and launches the script. It creates C:\Traces and logs activity there. A *** CLOSE sent *** line in the log corresponds to a dismissed popup and a matching System event log Event 26 (Application Popup). If a popup still appears without closing, note the timestamp and check whether it fired before the script started (the script only covers the ~5-minute window after it launches).
💡 Tip
Do not suppress the popup with ErrorMode registry settings. It can hide real failures. The closer script only dismisses this specific ShellHost dialog and touches nothing else.

 

 

 

Related articles