Library ucrtbase.dll consumes high amounts of CPU

Question

Recently I noticed that some application (DBeaver) can suddenly start to load the processor heavily (1 core). The application that loaded the processor (at different times) referred to the library ucrtbase.dll.

I found out this way:

I opened procmon and on the Threads tab I saw 1 thread that loads the process.

I saw a call stack like this: ucrtbase.dll!configthreadlocale+0x50

and it points to the file: C:\Windows\System32\ucrtbase.dll

I looked at the file properties of this file and saw:

File version: 10.0.19041.3636

Date of change: 14.11.2023 22:21

It seems to me that it is outdated.

How do I update it correctly?

I dismiss viruses, because I checked for virustotal - everything is fine.

Well, the file has a digital signature.

I ran a virus scan - everything is OK.

I have already run a system Update before, but the file has not been updated.

Since this file seems to belong to Visual C or C++, it occurred to me to update the installed components in Visual Studio Installer.

A simple update of Visual Studio Community 2022 and 2019 via the standard VS Installer did not help.

I tried installing Microsoft Visual C++ Redistributable separately, downloading them from here for both x86 and x64 versions, but it didn't help either:

https://learn.microsoft.com/en-us/cpp/windows/latest-supported-vc-redist?view=msvc-170

I tried to uninstall the old version and the new versions first, and then install the latest version. It didn't help either. After reinstalling, the computer was rebooted.

I found 114 such files "ucrtbase.dll" on my entire disk in different folders with different installed applications.

Here are the most relevant:

C:\Program Files (x86)\Microsoft Visual Studio\2019\Community\Common7\IDE\Remote Debugger\x64\ucrtbase.dllC:\Program Files (x86)\Microsoft Visual Studio\2019\Community\Common7\IDE\Remote Debugger\x86\ucrtbase.dll

File version: 10.0.1.14393.795

Date of change: 16.08.2024 21:42

How to upgrade it correctly?

I expect it is a root cause.

Answer 1

ucrtbase.dll is a Windows system component. It is usually found in the system32 folder but some applications that locally deploy dynamic link libraries may also have their own copies.

The image that you posted is not a call stack for a single thread. Note all the different values in the TID (Thread ID) column. Each of those is for a different thread created by the process.

The problem you are experiencing is symptomatic of an application that has created many threads. That those threads depend on ucrtbase.dll is not the problem. The application that is creating those threads is the source of your issue and that is where you should look for a solution.