Skip to content

Shell extension loads .NET Framework CLR into third-party processes, causing FAIL_FAST_SET_CONTEXT_DENIED (0xc0000409) crash in shadow-stack-enabled apps #783

Description

@leonatkins

Describe the bug

FileConverterExtension (via SharpShell) gets loaded into any process that uses Windows shell APIs. When the host process has Hardware-enforced Stack Protection (CET shadow stack) enabled, the legacy .NET Framework CLR's exception unwinding trips FAST_FAIL_SET_CONTEXT_DENIED and the entire host process is terminated with 0xc0000409.

I hit this with Raycast for Windows (v0.70, MSIX, modern .NET/coreclr): launching any console-subsystem app from Raycast (cmd, PowerShell, Git Bash) crashed Raycast 100% of the time. GUI apps and Windows Terminal launched fine. Uninstalling File Converter and rebooting fully resolved it.

To Reproduce

  1. Install File Converter (shell extension registered)
  2. Install Raycast for Windows on a CPU/OS with shadow stack enabled (Ryzen 9800X3D, Windows 11 26100)
  3. Open Raycast, type cmd, press Enter
  4. Raycast.exe crashes immediately, every time

Crash analysis (WinDbg, full dump)

FAILURE_BUCKET_ID: FAIL_FAST_SET_CONTEXT_DENIED_c0000409_clr.dll!ProcessCLRException
Subcode: 0x30 FAST_FAIL_SET_CONTEXT_DENIED
CLR.Version: 4.8.9337.0   <- legacy Framework CLR, loaded into a coreclr host process

Relevant stack:

ntdll!RcContinueExit+0x13
clr!ProcessCLRException+0x345
ntdll!RtlpExecuteHandlerForUnwind+0xf
ntdll!RtlUnwindEx+0x283
clr!ClrUnwindEx+0x40
clr!ProcessCLRException+0x2cc
ntdll!RtlDispatchException+0x437
ntdll!RtlRaiseException+0x221
KERNELBASE!RaiseException+0x8a
clr!RaiseTheExceptionInternalOnly+0x320
clr!UnwindAndContinueRethrowHelperAfterCatch+0x76
clr!JIT_Overflow+0x73          <- managed OverflowException thrown in extension code

Loaded modules in the crashed process include FileConverterExtension and SharpShell.

Chain: extension DLL loads into the host → SharpShell pulls in .NET Framework 4.8 CLR → managed OverflowException is thrown (clr!JIT_Overflow) → Framework CLR's unwinder violates shadow stack → Windows fail-fasts the host process.

Environment

  • File Converter version: [fill in your version]
  • Windows 11 build 26100 (24H2), x64
  • CPU: AMD Ryzen 7 9800X3D (CET shadow stack capable)
  • Host process: Raycast.exe 0.70.0.0 (MSIX)

Notes

Two separate issues here: (1) the OverflowException being thrown at all, and (2) more broadly, shadow-stack-enabled hosts will keep hitting this class of crash as long as the extension runs on the legacy Framework CLR in-process. Happy to provide the full .dmp file if useful.

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions