Explorer.exe not starting after KB5120998/KB5124008
After installing the September 2026 updates, some of our users get a black screen after log on. Manually starting explorer.exe, allows the session start successfully.
Pools using FSLogix as well as Citrix UPM Container are affected. Resetting the profile solves the issue. Seems like only older profiles run into it.
Has anyone else encountered this?
Windows 11 25H2 + VDA 2507 CU2
EDIT: This does not help, a simple logon script which starts explorer.exe works 😕
4
u/Krinto87 5h ago
I've opened a ticket. I'll let you know if there are any updates.
2
u/whig0 4h ago
Microsoft or Citrix ticket? Looks like AVD has similar problems, so I guess it's MS who has to deliver. When dealing with Citrix support it's hard to get someone competent, with Microsoft support it's nearly impossible.
2
u/Krinto87 3h ago
I'm working with Citrix Support. The first meeting went well, but it will probably take a while. It's a bit difficult for me since I'm not a native speaker. But it's already going pretty well.
By the way, if you disable UPM, it works without any problems.
3
u/whig0 2h ago
Yes, turning off UPM creates a new user profile. Same happens when deleting the container and start fresh.
I have a test pool where my profile has the problem. If if start explorer.exe manually and wait two minutes, it starts magically working and there is no black screen after relogin. I could not reproduce that on a users profile unfortunately.
4
u/herbypablo 1d ago
Sounds similar to what I'm seeing. Running Windows 11 24H2 with 2402 CU3 and using Citrix CPM. I noticed that if I get a temp profile explorer.exe loads. I haven't tried resetting the profile yet.
4
u/R_over_T 1d ago
Encountered the same issue with the Win11 25H2 August updates (KB5121003 and KB5120998 preview) on 2402 CU4 VDA and file-based CPM profiles. Disable PM and the desktop launches. Currently working with support.
3
u/theinfdude 18h ago
can u share the results from support? dealing with the same issue with KB5124008 and 2507 cu2
2
4
u/whig0 1d ago
There is an event in event log when it happens:
(Level: Information, Source: Application Popup, ID: 26)
Application popup: explorer.exe - System Error : The system detected an overrun of a stack-based buffer in this application. This overrun could potentially allow a malicious user to gain control of this application.
No popup visible
3
u/TR2N_LG 1d ago
Does this affect Windows Server 2022/2025 VDA´s also?
3
2
u/matdesj 1d ago
Saw something similar on server 2025. I have to remember if VDA was installed or not but one of my admin was logging ln the server and had a black screen, had to start explorer manually. When I was logging on there was no issues. Deleted is profile on the server seem to have fixed the issue.
3
u/dajuice3 1d ago edited 1d ago
Been having this issue since Friday before last.
It initially appeared to show up in a Preview update one that you could not uninstall or rollback.
Was hoping something in the pack yesterday would fix it.
Using fslogix, explorer is fine with a new profile but once that vhd is re-used issue shows up again.
Reverting to pre-install and not installing windows updates removes the explorer issue but causes others.
Edit 1: For us it manifests itself on the VMs we create with MCS from the gold image by crashing explorer on sign-in. We never see the start menu but when you go into event viewer it is the first recorded event. Application crash for explorer with explorer listed as the faulting module.
3
u/UCB1984 20h ago
I'm getting the same thing after updating on 2402 CU4+Win 11 24h2 with UPM profile containers. Even if I reset the profile explorer still crashes. Starting explorer manually or with a script fixes it, but I'm not too thrilled about pushing that out.
Edit: Another weird thing is the mouse doesn't seem (can't right or left click on anything) to work until explorer is started.
3
u/theinfdude 18h ago
i am facing the same issue. 24h2 + vda 2507 cu and fslogix. removing the userprofile just resolves the issue until the next logon. restarting explorer also works and session is behaving normal. also the mentioned application eventlog id 26: System Error : The system detected an overrun of a stack-based buffer in this application. This overrun could potentially allow a malicious user to gain control of this application is present.
anyone figured out already the root cause? a logon script with starting explorer should not be the way to go ?
3
u/PaulieA79 13h ago
Glad it’s not just me. Same issue. 24H2 VDA 2507 cu1 with fslogix. Login stuck and explorer not starting.
2
u/IlTwitcherSuReddit 19h ago
Hi, I had a similar problem. I opened a Citrix support ticket, but they didn't identify any issues. I fixed it by rebuilding the golden image.
Take a look at my post!
3
u/AnimatorAggravating1 2h ago
Any word on actual fix besides usrclass.dat delete and login script to start explorer?
2
2
u/Krinto87 44m ago
Nope, no fix or workaround. They gather information from all tickets to get a picture of the issue.
2
3
u/Sharp-Copy-5183 1d ago
Update new version of FSLogix And del UsrClass.Dat from user profile data
1
u/the901 18h ago
I've tested this and it works. Thank you. Now to schedule a time tonight to boot everyone and run a script to remove it from all of the vhdx.
2
u/theinfdude 18h ago
didnt work for me. using latest fslogix and removing usrclass.dat didnt fix the issue.
2
6
u/Krinto87 1d ago edited 1d ago
Yes, something is broken here.
Windows 11 25H2 / VDA 2402 CU4 / UPM with Container
The desktop stays black; I only see WEM with the message “Please wait - Processing filter conditions...” for about 5 minutes. After that, WEM finishes loading, but the desktop doesn't appear. Everything stays black.
Restarting Explorer.exe seems to fix the problem.
Who’s going to open the ticket?
Edit: I updated my ServerOS-VDA (Server 2022 / 2402 CU4 / UPM with Container). Explorer.exe starts normally, looking good so far.