IE11/WebBrowser control crashes when opening a .eml file after October 2016 Update Rollup RRS feed

  • Question

  • After installing the Security Updates from the October 2016 Rollup/Quality Update. IE crashes when you open an .eml file. An application hosting a WebBrowser control (ieframe.dll) also crashes when doing that. This happens on Win7 and Win10 (maybe others I couldn't test).

    Here is the error: 

    <Event xmlns="">
        <Provider Name="Application Error" />
        <EventID Qualifiers="0">1000</EventID>
        <TimeCreated SystemTime="2016-10-21T12:47:19.000000000Z" />
        <Security />
        <Data>C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE</Data>

    Is there anything to fix that? Uninstalling the Update works, but I don't like to recommend uninstalling security updates to my customers.

    Friday, October 21, 2016 1:10 PM


All replies

  • I might suggest to capture a user mode dump of the crash to get the most information an the crash.

    You can configure Windows to create user-mode dumps. Create a System Restore Point first.

    If you copy and paste the following in Notepad and save as a .reg file (save with the .reg extension and give it any name such as iedump.reg), then right-click the .reg file and select "Merge" to add to the registry, a .dmp file at the time iexplore.exe crashes should be created in the C:\CrashDumps folder:

    Windows Registry Editor Version 5.00
    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Windows Error Reporting\LocalDumps\iexplore.exe]

    After Internet Explorer (iexplore.exe) crashes, can you then make the .dmp file available (provide link) via a public folder on OneDrive (SkyDrive) or similar site?

    Here's a couple of links on using OneDrive (SkyDrive):

    More info on collecting user-mode dumps:

    To stop the creation of the user mode dump files run the following registry file:

    Windows Registry Editor Version 5.00

    [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Windows Error Reporting\LocalDumps\iexplore.exe]

    You can delete the C:\CrashDumps folder anytime.

    Saturday, October 22, 2016 12:40 AM
  • Is there anything to fix that?

    Supposedly it only happens when IE is being launched from the E-mail app?  E.g. a workaround is to save the file and then open it using IE.  No crash then apparently.

    BTW I saw this comment in a related thread on Answers but no search is working for me to find it.

    Robert Aldwinckle

    Sunday, October 23, 2016 3:09 AM
  • Hi C Steinhauser,

    According to your description, I check the Microsoft Security Bulletin Summary for October 2016. The KB3192887 is related to IE. We could uninstall it temporarily to check.

    The event doesn’t provide enough information. We could check the crash dump file as auggy said.

    Hope it will be helpful to you

    Please remember to mark the replies as an answers if they help and unmark them if they provide no help.
    If you have feedback for TechNet Subscriber Support, contact

    Monday, October 24, 2016 8:45 AM
  • The crash also happens when you drag an .eml file into an opened IE window. I will get a crash dump from doing that and report back.

    Sometimes IE doesn't crash and shows an "Address not valid" error. After further testing it seems that 0-byte files also display fine (white empty document) and text-only emails with only one mime part also seem to work. If you rename a multi-part .eml to .mht it also displays fine again.

    Monday, October 24, 2016 10:08 AM
  • Here is a minidump of the crash.!Am7yeR1WE-44hE8EoAv8beWxl5IX

    It shows this error:

    773ae43e 8b4604          mov     eax,dword ptr [esi+4]
    EXCEPTION_RECORD:  ffffffff -- (.exr 0xffffffffffffffff)
    ExceptionAddress: 773ae43e (ntdll!RtlInitUnicodeString+0x00000196)
       ExceptionCode: c0000005 (Access violation)
      ExceptionFlags: 00000000
    NumberParameters: 2
       Parameter[0]: 00000000
       Parameter[1]: 0abc9ca8
    Attempt to read from address 0abc9ca8
    PROCESS_NAME:  iexplore.exe
    FAULTING_MODULE: 76450000 kernel32
    MODULE_NAME: heap_corruption
    ERROR_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.
    EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.
    READ_ADDRESS:  0abc9ca8 
    773ae43e 8b4604          mov     eax,dword ptr [esi+4]
    LAST_CONTROL_TRANSFER:  from 773ae0a3 to 773ae43e
    Use '!findthebuild' command to search for the target build information.
    If the build information is available, run '!findthebuild -s ; .reload' to set symbol path and load symbols. ; Enable Pageheap/AutoVerifer
    FAULTING_THREAD:  00003744
    WARNING: Stack unwind information not available. Following frames may be wrong.
    04518aa4 773ae0a3 00000002 04518b50 00000001 ntdll!RtlInitUnicodeString+0x196
    04518abc 74d36e0a 00320000 00000000 065921a0 ntdll!RtlFreeHeap+0x7e
    04518ad0 74d36ef4 74e276bc 065921a0 04518ba0 ole32!CRetailMalloc_Free+0x1c [d:\w7rtm\com\ole32\com\class\memapi.cxx @ 687]
    04518ae0 74e6c9c8 065921a0 74f31648 00000000 ole32!CoTaskMemFree+0x13 [d:\w7rtm\com\ole32\com\class\memapi.cxx @ 475]
    04518ba0 74e6c1f4 04518d50 80004005 04518bd8 urlmon!BuildUserAgentString+0x5c1
    04518bb0 74e676af 00000000 045704b4 04518d50 urlmon!InitUserAgentGlobals+0x42
    04518bd8 63402b09 04518c1c 04518c18 04549500 urlmon!MapBrowserEmulationStateToUserAgent+0x3f
    04518d5c 63406df2 04570300 04518e58 065b3010 mshtml!CMarkup::PrepareDwnDoc+0x271
    04519154 636e973e 045191f0 00000000 00000000 mshtml!CMarkup::LoadFromInfo+0x121d
    045192a8 636e9247 045192c4 00000000 04519398 mshtml!CDoc::LoadFromInfo+0x4d9
    0451937c 74e76582 04549500 00000001 0038ac70 mshtml!CDoc::Load+0xef
    045193e4 74e75e08 06597148 04549500 00000000 urlmon!CBinding::ObjectPersistMnkLoad+0x1c8
    04519460 74e75c0b 06597148 045194d8 045194e8 urlmon!CBinding::InstantiateObject+0x118
    04519554 74e63174 06597148 00000000 0001a5c6 urlmon!CBinding::OnObjectAvailable+0x20b
    0451958c 74e65631 0001a5c6 0001a5c6 00000000 urlmon!CBinding::OnTransNotification+0x3a3
    045195c0 74e653a8 06597150 00000025 0001a5c6 urlmon!CBinding::ReportData+0xa1
    045195e8 74e6533c 004197dc 00000025 0001a5c6 urlmon!COInetProt::ReportData+0x54
    04519624 74e65253 00000025 0001a5c6 0001a5c6 urlmon!CTransaction::DispatchReport+0x19e
    0451966c 74e9a14a 004195f0 00000025 0001a5c6 urlmon!CTransaction::ReportData+0x331
    0451968c 74e66dc6 004195f0 00000025 0001a5c6 urlmon!CINet::ReportDataHelper+0x26
    045197bc 74e99f56 00000025 0001a5c6 00000000 urlmon!CINet::ReportDataToProtocolSink+0xf2
    0451a018 74e669e0 74e66610 74e5f0f0 0041a4cc urlmon!CINetFile::INetAsyncOpen+0x5f8
    0451a05c 74e6662a 0658f5bc 004195f0 004195f8 urlmon!CINet::StartCommon+0x3ce
    0451a078 74e6201b 0041a230 0658f5bc 004195f0 urlmon!CINet::StartEx+0x1a
    0451a0b4 74e60e46 004197d8 0658f5bc 004195f0 urlmon!COInetProt::StartEx+0x184
    0451a570 74eb1213 00419608 0658f5bc 06597150 urlmon!CTransaction::StartEx+0xd9e
    0451a5f0 74e6396c 0658f5bc 065818d0 027ea5a0 urlmon!CBinding::StartBinding+0x921
    0451a63c 74e75066 065818d0 00000000 027ea5a0 urlmon!CUrlMon::StartBinding+0x1a6
    0451a68c 029d3883 0038ac70 065818d0 00000000 urlmon!CUrlMon::BindToObject+0xc9
    0451a6d0 02825eb0 0038ac70 065818d0 00000000 ieframe!CDocObjectHost::_StartAsyncBinding+0x1da
    0451b784 0451b7d0 02825aba 0038ac70 00000000 ieframe!CDocObjectHost::SetTarget+0x3cc
    0451b8a4 69e4d50d 0057d0e0 11cf3573 000869ae 0x451b7d0
    0451b8dc 028240e5 0002234e 0451b96c 819dff3c comctl32!ImageList_Draw+0xee6
    0451b8f8 003ce6d0 00000000 00000000 00000000 ieframe!GetEffectiveClientRect+0x33
    0451b908 0451b96c 0451b960 0451ba08 00000000 0x3ce6d0
    00000000 00000000 00000000 00000000 00000000 0x451b96c
    SYMBOL_NAME:  heap_corruption!heap_corruption
    FOLLOWUP_NAME:  MachineOwner
    IMAGE_NAME:  heap_corruption
    STACK_COMMAND:  .cxr 0000000000000000 ; kb ; ~8s; .ecxr ; kb
    FAILURE_BUCKET_ID:  HEAP_CORRUPTION_c0000005_heap_corruption!heap_corruption

    Monday, October 24, 2016 10:55 AM
  • Can you provide a few more dump files preferably from different machines to see if the error is consistent?

    Could be an issue with the wlidcli.dll (Windows Live dll) :

    Unable to load image C:\Program Files (x86)\Internet Explorer\IEShims.dll, Win32 error 0n2
    *** WARNING: Unable to verify timestamp for IEShims.dll
    *** WARNING: Unable to verify timestamp for iexplore.exe
    Unable to load image C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\wlidcli.dll, Win32 error 0n2
    *** WARNING: Unable to verify timestamp for wlidcli.dll
    *** ERROR: Module load completed but symbols could not be loaded for wlidcli.dll
    Probably caused by : heap_corruption ( heap_corruption!heap_corruption )

    Also, is the software Hardcopy installed on all computers with the issue?

    Tuesday, October 25, 2016 2:01 AM
  • Installing Windows Live Mail is required for IE (and the Control) to decode mime. If it is not installed IE will only display the mail's source including headers. Hardcopy is not installed on all PCs having the Problem, Windows Live Mail should be installed however.
    Tuesday, October 25, 2016 10:31 AM
  • Installing Windows Live Mail is required for IE (and the Control) to decode mime.
    I think you could also try renaming the .eml file to .mht.

    Robert Aldwinckle

    Tuesday, October 25, 2016 11:59 AM
  • Yes, that also works, as I already reported yesterday. Sadly it's not an option for use in our software. Thanks for the feedback.

    Here is another minidump, this time with a slightly different trace and without hardcopy running, on the same PC though:!Am7yeR1WE-44hFDEOBi93h2CI07Q


    77532ed5 8b19            mov     ebx,dword ptr [ecx]
    EXCEPTION_RECORD:  ffffffff -- (.exr 0xffffffffffffffff)
    ExceptionAddress: 77532ed5 (ntdll!RtlpFreeHeap+0x000004d6)
       ExceptionCode: c0000005 (Access violation)
      ExceptionFlags: 00000000
    NumberParameters: 2
       Parameter[0]: 00000000
       Parameter[1]: 00430038
    Attempt to read from address 00430038
    PROCESS_NAME:  iexplore.exe
    ERROR_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.
    EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.
    READ_ADDRESS:  00430038 
    77532ed5 8b19            mov     ebx,dword ptr [ecx]
    LAST_CONTROL_TRANSFER:  from 77532bd5 to 77532ed5
    ADDITIONAL_DEBUG_TEXT:  Enable Pageheap/AutoVerifer ; Followup set based on attribute [Is_ChosenCrashFollowupThread] from Frame:[0] on thread:[PSEUDO_THREAD]
    FAULTING_THREAD:  000018a0
    044e71a4 77532ed5 ntdll!RtlpFreeHeap+0x4d6
    044e728c 77532bd5 ntdll!RtlFreeHeap+0x142
    044e72ac 76a76e0a ole32!CRetailMalloc_Free+0x1c
    044e72c0 6fec1198 inetcomm!MimeOleParseMhtmlUrlW+0x95
    044e72e4 6fec96ad inetcomm!CActiveUrlRequest::QueryService+0x31d
    044e7f54 6fec9c4b inetcomm!CActiveUrlRequest::ParseUrl+0x107
    044e83a4 75aea150 urlmon!COInetSession::ParseUrl+0x15e
    044e8440 75ab7e15 urlmon!CoInternetGetSecurityUrlEx+0x1b0
    044e84a0 75aebede urlmon!CSecurityManager::GetSecurityIdEx2Internal+0x5d7
    044e8a10 75aebe7c urlmon!CSecurityManager::GetSecurityIdFromUriInternal+0x14a
    044e8a5c 75aebcf7 urlmon!GetZoneAgnosticSecurityIdFromUri+0x21c
    044e8a8c 629f927c mshtml!CMarkup::GetSecurityIdOfUriOptimistic+0x13b
    044e8ac8 629f9407 mshtml!CMarkup::GetSecurityIdOptimistic+0x6a
    044e8af8 629f9307 mshtml!CMarkup::GetSecurityID+0x28
    044e8b24 629e5be5 mshtml!CMarkup::UpdateSecurityID+0x57
    044e8d58 629e6bac mshtml!CMarkup::LoadFromInfo+0xfaa
    044e9134 62cc973e mshtml!CDoc::LoadFromInfo+0x4d9
    044e9288 62cc9247 mshtml!CDoc::Load+0xef
    044e935c 75ad6582 urlmon!CBinding::ObjectPersistMnkLoad+0x1c8
    044e93c4 75ad5e08 urlmon!CBinding::InstantiateObject+0x118
    044e9440 75ad5c0b urlmon!CBinding::OnObjectAvailable+0x20b
    044e9534 75ac3174 urlmon!CBinding::OnTransNotification+0x3a3
    044e956c 75ac5631 urlmon!CBinding::ReportData+0xa1
    044e95a0 75ac53a8 urlmon!COInetProt::ReportData+0x54
    044e95c8 75ac533c urlmon!CTransaction::DispatchReport+0x19e
    044e9604 75ac5253 urlmon!CTransaction::ReportData+0x331
    044e964c 75afa14a urlmon!CINet::ReportDataHelper+0x26
    044e966c 75ac6dc6 urlmon!CINet::ReportDataToProtocolSink+0xf2
    044e979c 75af9f56 urlmon!CINetFile::INetAsyncOpen+0x5f8
    044e9ff8 75ac69e0 urlmon!CINet::StartCommon+0x3ce
    044ea03c 75ac662a urlmon!CINet::StartEx+0x1a
    044ea058 75ac201b urlmon!COInetProt::StartEx+0x184
    044ea094 75ac0e46 urlmon!CTransaction::StartEx+0xd9e
    044ea550 75b11213 urlmon!CBinding::StartBinding+0x921
    044ea5d0 75ac396c urlmon!CUrlMon::StartBinding+0x1a6
    044ea61c 75ad5066 urlmon!CUrlMon::BindToObject+0xc9
    044ea66c 027d3883 ieframe!CDocObjectHost::_StartAsyncBinding+0x1da
    044ea6b0 02625eb0 ieframe!CDocObjectHost::SetTarget+0x3cc
    044eb768 02625aba ieframe!CDocObjectView::_CreateViewWindow+0x130
    044eb7b0 0262591e ieframe!CDocObjectView::CreateViewWindow3+0x5e
    044eb7f4 0262588d ieframe!FileCabinet_CreateViewWindow2+0x194
    044eb8d4 026256e8 ieframe!CBaseBrowser2::_CreateViewWindow+0x3a
    044eb8fc 026255d2 ieframe!CBaseBrowser2::_CreateNewShellView+0x2ae
    044eb964 0262617e ieframe!CBaseBrowser2::_CreateNewShellViewPidl+0xc4
    044eb9a0 02626047 ieframe!CBaseBrowser2::v_NavigateToPidl+0x2bd
    044eca40 027ebf77 ieframe!CShellBrowser2::_InitializeWindow+0x258
    044eca78 026a2d11 ieframe!CShellBrowser2::_Initialize+0x244
    044ecb18 026b076d ieframe!CShellBrowser2_CreateInstance+0x6a
    044ecb48 025ea802 ieframe!CTabWindow::_TabWindowThreadProc+0x1ec
    044efd24 0267ade8 ieframe!LCIETab_ThreadProc+0x3e7
    044efde4 76cb263c iertutil!CMemBlockRegistrar::_LoadProcs+0x67
    044efdfc 56463a31 ieshims!NS_CreateThread::DesktopIE_ThreadProc+0x94
    044efe34 76f4336a kernel32!BaseThreadInitThunk+0xe
    044efe40 77539902 ntdll!__RtlUserThreadStart+0x70
    044efe80 775398d5 ntdll!_RtlUserThreadStart+0x1b
    STACK_COMMAND:  .cxr 00000000044E6D40 ; kb ; dds 44e71a4 ; kb
    SYMBOL_NAME:  heap_corruption!heap_corruption
    FOLLOWUP_NAME:  MachineOwner
    MODULE_NAME: heap_corruption
    IMAGE_NAME:  heap_corruption
    FAILURE_BUCKET_ID:  HEAP_CORRUPTION_c0000005_heap_corruption!heap_corruption
    I will try to see if it works without wlidcli.dll as it seems it's not needed on my PC (without the October updates). I can unregister/rename it and still view .eml files fine.

    Tuesday, October 25, 2016 12:34 PM
  • Yes, that also works, as I already reported yesterday. Sadly it's not an option for use in our software.

    So what is WLMail needed for?  Just converting .eml to .mht and passing to IE?  FWIW if I try to open an .eml WLMail is launched.  In order to make IE open it I need to rename it (or change the association for the .eml file extension.)  You may get some insight about what is going on by using ProcMon.  Filter with  Operation Begins with Proc  at first. 

    Another possibility I suppose may be using a registry override to make the other app think it is using a lower version of IE than is actually available...

    (BING Search for
     FEATURE_BROWSER_EMULATION registry override internet explorer version embedded application  


    To control the value of this feature by using the registry, add the name of your executable file to the following setting and set the value to match the desired setting.



    Robert Aldwinckle

    Tuesday, October 25, 2016 2:26 PM
  • The way we implemented it is: A Browser Control in a window pane acts as preview for emails saved on a network folder. That worked fine since Windows XP without any changes. To make it work on Win7 and above Live Mail was needed, until now, now the host application crashes.

    I will look into making the control display it as mht, that would remove the need to have WLMail and might be preferable. Funnily the mimetype in the registry is "message/rfc822" for both.

    But you know how customers are: "That has worked for the last 10 years and now you broke it."

    EDIT: I have tried using FEATURE_BROWSER EMULATION to force IE9 mode but the crash happens just like with a standalone iexplore.

    Tuesday, October 25, 2016 2:43 PM
  • Turns out Live Mail is not required after all. The only thing required is this registry key, that WLMail creates:

    "Content Type"="message/rfc822"

    IE is still crashing when the update is installed though even after uninstalling WLMail.

    I will try it on another Computer without Outlook maybe it is connected...

    Tuesday, October 25, 2016 4:47 PM
  • Here is a new crashdump from Windows Server 2012 R2:!Am7yeR1WE-44hFFr05J_F3wCm3R2

    On that system the crash happens as soon as KB3185331 is installed.

    It appears to be connected to the filename length though. Looks like a buffer overflow somewhere.

    The crash in the dump was this file: C:\APL\MailFolders\Inbox_APL_10-2016\00000000106A42B3CC0DC64DB67FBA513846240F070034AD76187591974DBF6C4F76951C873A0100000000000000AC78907B68C81A479F8E7AE9EE2C0E9A0000000072050000.eml

    If I rename the file to: test.eml it displays fine.

    After further testing the "magic spot" seems to be around 128 bytes for the filename + path. At that length it will randomly crash, display correctly or display and then crash. Here is the path I used for testing: \\demo\c$\APL\MailFolders\Inbox_APL_10-2016\1234567890123456789012345678901234567890123456789012345678901234567890123456789012.eml

    on a side note (has nothing to do with this bug, is just some "interesting behavior"):!Am7yeR1WE-44hFIL-O3CZICL1xJC

    .eml files will only display correctly from a UNC path (DEMO is the local server in the screenshots). The customer uses german locale, the error displayed is: "The address is not valid". That doesn't matter for the WebBrowser Control however. It seems to just be an IE quirk.

    Wednesday, October 26, 2016 12:55 PM
  • Can you ensure the following update is installed which should update the Inetcomm.dll and Inetres.dll:

    Same issue with file length with mht files in the following link and I believe 3200006 fixes that issue and hopefully will fix the issue with eml files.

    • Marked as answer by C Steinhauser Wednesday, October 26, 2016 3:08 PM
    Wednesday, October 26, 2016 2:04 PM
  • Brilliant,

    KB3200006 fixed the problem. No more crashing. The update did not install via Windows Update or WSUS, it had to be installed manually.

    Thanks a lot!

    EDIT: The Win10 Update KB3199125 is over 1GB... wow. I guess that's the downside of cumulative updates. Also: the links to Download Catalog in all KB articles are broken...
    Wednesday, October 26, 2016 2:30 PM
  • You're welcome. Thanks for letting us know KB3200006 fixed the issue.
    Wednesday, October 26, 2016 4:04 PM
  •  I could not find the KB3200006 for Windows 10 Version 1607 and the KB3199125 couldnt be installed.


    the yesterday installed cumulative update KB3197954 fixed the problem for me :-)

    Many thanks @all!

    Friday, October 28, 2016 11:44 AM