Control Flow Guard Exception When Using Outlook Object Model

Question

We're seeing multiple clients of our Outlook COM Add-in experiencing outlook crashing after upgrading Outlook to any of the November 9th updates across at least two of the update channels (Monthly Enterprise 2209 (15629.20258) and Semi-Annual Enterprise: 2202 (14931.20806)). We're still in the investigation phase of trying to determine root cause, but we have some data at this point.

The EventViewer error is:

Faulting application name: OUTLOOK.EXE, version: 16.0.15629.20258, time stamp: 0x63603097 Faulting module name: ucrtbase.dll, version: 10.0.19041.789, time stamp: 0x2bd748bf

Sometimes it is ntdll.dll instead of ucrtbase.dll

We've gotten a couple crash dumps from one of our customers and the line that throws exceptions are different, but they're also rather innocent. In one place we do this:

Dim propertyAccessor As Microsoft.Office.Interop.Outlook.PropertyAccessor = mail.PropertyAccessor   

and the other:

Dim mail As Microsoft.Office.Interop.Outlook.MailItem = TryCast(item, Microsoft.Office.Interop.Outlook._MailItem)   

We use Add-in Express and in both those cases, the callstack shows our code being called from:

AddinExpress.MSO.2005.dll!AddinExpress.MSO.ADXOutlookAppEvents.DoExplorerSelectionChange(object explorer) > AddinExpress.MSO.2005.dll!AddinExpress.MSO.ADXAddinModule.OlExplorerEvents_10_SinkHelper.AddinExpress.MSO.IExplorerEvents_10.SelectionChange()

Finally, the exception in the dump files from the customer is:

Unhandled exception at 0x00007FFF720BC67F (ntdll.dll) in OUTLOOK.EXE.7468.dmp: Indirect call guard check detected invalid control transfer.

Does anyone know how a variable assignment or a TryCast could trigger a Control Flow Exception? Or any steps we could do to get more information about the root cause?