Faulting module KERNELBASE.dll: why programs crash in it and how to fix them

KernelBase.dll is a core part of Windows that every program loads. When a crash report or Event Viewer names it as the faulting module, the file is almost never broken: it is the place where Windows raises the error a program threw and did not handle. The exception code in the same report tells you what went wrong, and the fix is usually the program, its .NET or Visual C++ runtime, or a damaged Windows file.

uGetFix Editorial Team
Published · Data read on October 14, 2026

Prefer to fix it yourself? The manual steps follow.

How to fix a KERNELBASE.dll crash

Open Event Viewer and find the Application Error event of the crash. Two lines matter: the faulting application, which is the program that really failed, and the exception code. 0xe0434352 is an unhandled .NET exception, 0xe06d7363 a C++ exception the program did not catch, and 0xc0000409 a program that stopped itself because it found its own memory in a broken state. In each case update or repair that program and the runtime it uses (.NET or Visual C++), remove its add-ons, and only then install Windows updates and run sfc /scannow and DISM from an administrator Command Prompt.

Replacing KernelBase.dll does not fix these crashes. The same genuine file runs inside every program on your PC, including the ones that work, and Windows repairs and updates it on its own. If it were really damaged, Windows itself would fail to start, not one program.

The order of fixes for a KERNELBASE.dll crash: read the event, look up the exception code, repair the program and its runtimes, then Windows Update, sfc /scannow and DISM
Start with the program that crashed and its exception code; the Windows repairs come last.

Step by step

  1. Find the crash in Event Viewer. Press Windows + X, choose Event Viewer, then open Windows Logs, Application. Look for an Error with the source Application Error and Event ID 1000 at the time of the crash. Its text names the faulting application, the faulting module KERNELBASE.dll with its version, the exception code and the fault offset. Write down the application name and the exception code: they decide everything that follows.
  2. Read the event just before it. A .NET program usually leaves a second Error a moment earlier, with the source .NET Runtime and Event ID 1026. That event shows the real .NET exception, such as a missing file, a denied folder or a broken settings file, and the method it happened in. It often names the problem in plain words, which the Application Error event cannot do. Windows Error Reporting events with Event ID 1001 add the same crash with a bucket name, useful if you contact the program's support.
  3. Look up the exception code. Use the table of codes below. The code says which kind of failure it was: an unhandled .NET exception, an uncaught C++ exception, a fail-fast stop, an access violation. The same code across several crashes of one program means one cause in that program. Different programs all crashing with different codes points to Windows, a driver or software that injects into every program, such as overlays and some security tools.
  4. Update or repair the program that crashed. Install the newest version from its publisher. If it crashes at start, reset its settings or rename its settings folder under AppData, remove or update its plug-ins and add-ons, and for games turn off overlays and mods. Reinstall it if updating changes nothing. Most crashes reported in KernelBase.dll end here, because the error was raised by the program's own code.
  5. Repair the runtimes it uses. For 0xe0434352 install or repair the .NET version the program asks for: .NET Framework 4.8 comes with Windows and its updates, and newer .NET Desktop Runtimes are installed from Microsoft's .NET download page. For 0xe06d7363 and many 0xc0000409 crashes, open Settings, Apps, Installed apps, find each Microsoft Visual C++ Redistributable, choose Modify and Repair, or install the newest x64 and x86 packages from Microsoft.
  6. Install Windows updates and restart. Open Settings, Windows Update, install everything that is offered, optional driver and .NET updates included, and restart even if Windows does not ask. Updates replace system files with the current build for your Windows release, and that includes KernelBase.dll.
  7. Run System File Checker, then DISM. Type cmd in the Start menu, right-click Command Prompt and choose Run as administrator. Run sfc /scannow and wait until it reaches 100%. If it reports files it could not repair, run DISM /Online /Cleanup-Image /RestoreHealth in the same window, then sfc /scannow once more and restart. This repairs a damaged KernelBase.dll or any other protected system file, but it does not touch the program that crashed.
  8. Still crashing: start Windows with no extra software. Run msconfig, on the Services tab tick Hide all Microsoft services and choose Disable all, then disable the startup apps in Task Manager and restart. If the program now works, something that loads into it, such as an overlay, a screen recorder, a mouse or keyboard utility or a security tool, causes the crash. Turn items back on in groups until it returns. On Windows 11, Settings, System, Recovery, Fix problems using Windows Update reinstalls Windows and keeps your files and apps.

Download the genuine KernelBase.dll for your Windows version

Each file below is Microsoft's own KernelBase.dll for one Windows release, fetched from Microsoft's own server and checked against Winbindex, the index of the files in Windows images and updates. It is here for comparison: to check a copy you found, or to see which build your Windows should have. Replacing KernelBase.dll does not fix crashes, because the crash is raised in it, not caused by it. Pick your Windows version (Settings, System, About shows it) and the build: 64-bit for System32, 32-bit for SysWOW64.

Older Windows releases

A free uGetFix account is needed to download. Sign in, or create one in a minute, and you come straight back here.

What not to do

Do not replace KernelBase.dll in System32 or SysWOW64.

Every program on the PC, Windows itself included, loads this file. A copy of the wrong build or the wrong Windows release can stop Windows from starting at all, which turns one crashing program into a PC that needs recovery media. Windows protects the file and repairs it with sfc /scannow and DISM.

Do not download KernelBase.dll from a DLL collection site.

You cannot tell which Windows release, update or architecture the file comes from, or whether it was changed. A system file that matches nothing Microsoft has published is a security risk, and it would not stop the crash anyway.

Do not run regsvr32 on KernelBase.dll.

Some answers online suggest registering the file. KernelBase.dll is not a COM component and has no registration function, so the command only ends with an error message. Nothing about the crash changes.

Do not stop at sfc /scannow when it finds nothing.

A clean result is the normal outcome for this error. It means Windows is fine and the cause sits in the program, its add-ons or its runtime. Go back to the exception code and the program that crashed.

Do not turn off Data Execution Prevention or your antivirus to make it run.

If a program only runs with protection off, it either has a bug that the protection catches or it is doing something it should not. Update the program or ask its publisher instead of lowering the protection of the whole PC.

Check the copy on your PC

Choose the KernelBase.dll you are unsure about, for example one you found outside the Windows folders. Its checksum is calculated in your browser and compared with 1,328 Microsoft builds of the file from Windows releases and updates.

or drop the file here

The file stays on your computer. Nothing is uploaded: the checksum is computed locally.

Found a KernelBase.dll outside System32 and SysWOW64, in Downloads, Temp, AppData or a program folder? Windows never puts it there, and that is a security question, not a crash one. Is the kernelbase.dll on your PC genuine? On 2-Spyware

The exception codes and what each one means

Windows writes the code into the Application Error event and into crash dialogs as Exception code. The faulting module stays the same, KERNELBASE.dll; the code changes with the cause. These are the codes people find most often next to it.

The exception codes logged with KERNELBASE.dll as the faulting module, what each one means and the fix for each
The faulting module stays KERNELBASE.dll; the exception code tells you the cause.
Faulting module name: KERNELBASE.dll ... Exception code: 0xe0434352

An unhandled .NET exception. The program, written in .NET, hit an error its own code did not catch, and the .NET runtime passed it to Windows. The .NET Runtime event with ID 1026 just before it names the real error. Usual fixes: update the program, reset or delete its broken settings file, install or repair the .NET version it needs.

Faulting module name: KERNELBASE.dll ... Exception code: 0xe06d7363

A C++ exception that the program threw and did not catch. The hex digits spell msc, the marker of exceptions thrown by Microsoft's C++ compiler. The cause is inside the program or one of its plug-ins: often a missing or unreadable file, a failed network call or an unsupported graphics setting. Update the program, remove plug-ins, repair the Visual C++ Redistributable.

Faulting module name: KERNELBASE.dll ... Exception code: 0xc0000409

A stack buffer overrun or fail-fast stop. The program detected that its own memory was in a broken state, or called the fail-fast function on purpose, and Windows ended it at once so the damage could not spread. It is a program bug, an incompatible add-on or a mismatched runtime, not damage in KernelBase.dll. Update the program and its Visual C++ runtimes, remove add-ons and overlays.

Faulting module name: KERNELBASE.dll ... Exception code: 0xc0000005

An access violation: code read or wrote memory it was not allowed to use. With KernelBase.dll named, the bad address usually came from the program, a plug-in or software that injects into it. If many different programs crash this way, test the memory with Windows Memory Diagnostic and update your drivers.

The procedure entry point could not be located in the dynamic link library KERNELBASE.dll.

The program asked Windows for a function that your Windows release does not have. This happens when a program built for a newer Windows runs on an older one, or with a damaged or mixed copy of system files. Install Windows updates, check the program's system requirements, and run sfc /scannow.

The code execution cannot proceed because KERNELBASE.dll was not found.

Very rare, because Windows cannot start without this file. Seen when a program carries its own broken copy, or on a badly damaged Windows. Run sfc /scannow and DISM; if Windows itself misbehaves, repair it in place from Settings, System, Recovery.

File facts

KernelBase.dll holds the basic Windows functions that programs call for files, memory, processes, threads, the registry and error handling. Microsoft moved much of this code out of kernel32.dll and advapi32.dll into KernelBase.dll in Windows 7, and the older libraries pass many calls on to it. One of its functions, RaiseException, is how a program throws an error, which is why the file appears in so many crash reports. What Windows reports for the genuine file:

Description in the file
Windows NT BASE API Client DLL
Where the genuine kernelbase.dll belongs
C:\Windows\SysWOW64C:\Windows\System32

On 64-bit Windows, System32 holds the 64-bit file and SysWOW64 the 32-bit one; the folder names are historical. The name on disk is written KernelBase.dll, and Event Viewer prints it in capitals. The genuine file describes itself as Windows NT BASE API Client DLL (Properties, Details, File description) and is a few megabytes: in Windows 11 24H2 and 25H2 the 64-bit file delivered by update KB5124010 is 4,254,808 bytes and the 32-bit one 3,006,264 bytes. The version in the Application Error event is your KernelBase.dll build, not the version of the program that crashed.

Why crash reports name KernelBase.dll: a program throws an error, KernelBase.dll raises it, nothing handles it and Windows ends the program
The program throws, KernelBase.dll raises the exception, and Windows records the place it was raised as the faulting module.

KernelBase.dll versions by Windows release

Every Windows release has its own build of KernelBase.dll, and almost every monthly update brings a new one. Winbindex lists 1300 distinct Microsoft builds; the table shows the newest one indexed for each release and the update that delivered it.

Windows releaseFile versionDelivered bySize, 64-bit
Windows 11 26H110.0.28000.2704KB5121000, August 11, 20264,241,008 bytes
Windows 11 25H210.0.26100.9549KB5124010, September 22, 20264,254,808 bytes
Windows 11 24H210.0.26100.9549KB5124010, September 22, 20264,254,808 bytes
Windows 11 23H210.0.22621.7376KB5099414, July 14, 20263,997,184 bytes
Windows 11 22H210.0.22621.7376KB5099414, July 14, 20263,997,184 bytes
Windows 11 21H210.0.22000.3260KB5044280, October 8, 20243,720,392 bytes
Windows 10 22H210.0.19041.7725KB5129236, September 14, 20263,115,200 bytes
Windows 10 21H210.0.19041.7725KB5129236, September 14, 20263,115,200 bytes
Windows 10 21H110.0.19041.7725KB5129236, September 14, 20263,115,200 bytes
Windows 10 20H210.0.19041.7725KB5129236, September 14, 20263,115,200 bytes
Windows 10 200410.0.19041.7725KB5129236, September 14, 20263,115,200 bytes
Windows 10 190910.0.18362.2274KB5013945, May 10, 20222,777,248 bytes

Older copies of KernelBase.dll found on PCs

Public DLL catalogues have collected 28 copies of KernelBase.dll uploaded from PCs, from version 6.1.7600.16385 to 10.0.19041.804. Many come from older Windows releases. The table lists each with its checksums, so you can tell which one you have.

None of these replaces the file your Windows ships: the newest build indexed for Windows is 10.0.28000.2704, and each release keeps its own. If the check on this page finds your file in this list, it is most likely an older Microsoft build that was copied somewhere by hand. Confirm the Microsoft signature and let Windows use its own copy.

VersionBuildSizeMD5SHA-1
10.0.19041.80464-bit2.8 MBb8a68d71b2d71721308c02bf5a42e74424638330358ed7d942a1b7bcc6a8988c56eed5ac
10.0.19041.57264-bit2.8 MBb2b9f1f841b02012b613ec09bbe7b359b7baa5e84e19d2075c825666d11f328e528ff36e
10.0.19041.32932-bit2.1 MB1c0cae58c84afb7e143090a5bc0a22046d0a4e0295306a978e44b11662e81c1feb9e8909
10.0.18362.104964-bit2.6 MBd62f3401037d0d0ce1f41555b72f1b600be0e331f4f9c2ed8c9d989cdcfd10463fe3e047
10.0.18362.81564-bit2.6 MB62efe9b7fb6331c6fa48bee9cde43a28b8c3a63510820a6946b0d1e27ff0fe8508566a24
10.0.18362.81532-bit2.0 MB8624611ff499a6041966d6a60c2bcca7978298f9c09abd0d4d408c72a8f45fa7cc66efe3
10.0.18362.77864-bit2.6 MBba277d764c975cb56bdd8a595c4fa6cb696331a75fc931a4ccae7a7337d3b073c29747c7
10.0.18362.75264-bit2.6 MBff96fde4b79f681a2f8f9ef8541c964e1e32cd455a57a2da11a7939143f972ce952874b8
10.0.18362.62832-bit2.0 MB34bbae24d8fcdb977ac23b494d457fe2587235e54a06647e5566dcb9d5aa605ded8866e6
10.0.18362.26764-bit2.6 MB43483ef9dd70a2cbb631e02aa45454c6bdf8cafebe705cba4849db5a9b932f92b55facee
10.0.18362.164-bit2.6 MBf6749bd7c5d1e8e4bb687091254d23d63a200170db32a6fb4a82764086d6e2427c9a9a33
10.0.17763.91464-bit2.6 MB1ae0e7a9d6ce3b36c2f4eb48cf154978852f50bce707989692f99df5b6d6ed8db3f105ac
10.0.17134.11264-bit2.4 MB3b24ce6ca62a04b42d4730f0805e992cdfd3c9b12e3002c73dccc91c6e54dff311ec33b0
10.0.16299.40264-bit2.4 MB28ad30ca148118f25cbca669813af4e9817820fa4b84646c8af3a39d514e87b4ce6424b7
10.0.14393.064-bit2.1 MBcbf9f16411ed35264c1efaa70eeaad472ec59272434b288b1768e6a99d416a1fb11ff8d6
10.0.14393.032-bit1.6 MBceebf69badf2bb88d30546b3cd567edd7119651d18d392c697db330ad24d5bdb47e4edd3
10.0.10586.49464-bit1.9 MB9b2bfadcb00cf39f0ebd3d690fc56220ce5062ad10a8814dacddbef6a91d0b92b2bf6f12
10.0.10586.49432-bit1.5 MBf45e83301a6c99d342c600b5b29bcd71c50e7ddbfe6a4df063ab60defa9e99f34cfd285f
10.0.10586.16232-bit1.5 MB2d0c2ab110a51895d9d1e875201013de53fbd6bde6e0f92964b48790e4ee2b2ed7a88d29
6.3.9600.1705532-bit840 KB057d0aabb078ebd9e276f86f893e5b871ed3c07df9d3660215f94bfd1bae8fdc76d14401
6.3.9600.1638432-bit819 KB04b04c070ee3f41edf92fb3c3d52a4045a102918bef442a172b8a6e777f3b8a003e4544c
6.2.9200.1686432-bit737 KB1ad2db7b187610b67e69f4a34a4e0708bb8c67951cc288bf4a5ecda3c9b8bb01e67467f1
6.2.9200.1638432-bit645 KB6fb123ed73c7ef0a5f8c8570c99526760e51bcba55ecda11f1cbce6abea929368e613bb1
6.1.7601.1913532-bit266 KB3ecf55a5d03f20baf2189de7c334e7f9b28e0a33d7f1950e573f3545ab3cf27b20d61e0b
6.1.7601.1822932-bit287 KB1e65cf7b26d02750544efdd73c8118fad9391d1f8f9c2cc785ca1e021b614c3f341f674f
6.1.7601.1801532-bit266 KBe954a79d6a754a5475582caced1565e690b069cbc93c701394b47d4e830cdd7d384f5d5c
6.1.7601.1751432-bit266 KB61eabc3358d869519d851b08c8fa512d36e86308597d6e514e303a89e45b3d31ee6345ed
6.1.7600.1638532-bit276 KBb03c89367c03c19a742482dc78904dd04dc055d5d64f5ba45347e0a5a372c306e65fa639

Copies uploaded by users to a public DLL catalogue, read on 14 October 2026. We list their checksums so you can identify a file; we do not offer them for download and we did not verify each one against Microsoft's signature.

Questions people ask

Why does every crash report say KERNELBASE.dll?

Because KernelBase.dll is where Windows raises exceptions. When a .NET, C++ or other program throws an error, the call goes through RaiseException in KernelBase.dll. If nothing in the program catches it, Windows ends the program and records the place the exception was raised, which is KernelBase.dll, as the faulting module. The faulting application and the exception code are the parts that tell you what failed.

What does exception code 0xe0434352 mean?

It is the code Windows logs for an unhandled .NET exception. It says only that a .NET program failed, not why. The .NET Runtime event with ID 1026, logged just before the Application Error, names the actual exception and where it happened. Updating the program, resetting its settings and repairing the .NET version it needs fixes most of these crashes.

Will downloading a new KernelBase.dll fix the crash?

No. The file that Windows has is the same one that every working program on your PC uses at the same moment. A crash reported in it is raised there, not caused by it. If the file really were damaged, sfc /scannow and DISM repair it from Microsoft's own sources, and a hand-copied file of the wrong build can stop Windows from starting.

System File Checker found no problems. What now?

That is the expected result. It means Windows' own files, KernelBase.dll included, are intact and the cause lies in the program that crashed. Go back to the exception code and the faulting application in Event Viewer, update or reinstall that program, repair its .NET or Visual C++ runtime, and try a clean boot to rule out overlays and other software that loads into it.

Why do several different programs crash with KERNELBASE.dll?

When the crashes come from many programs with different codes, look for something they share: a pending Windows or driver update, software that injects into every program such as overlays, screen recorders or security tools, a damaged runtime, or faulty memory. Install updates, run sfc /scannow and DISM, test with a clean boot, and run Windows Memory Diagnostic.

Can KernelBase.dll be a virus?

The copies in System32 and SysWOW64 are genuine Windows files. A KernelBase.dll anywhere else is not Windows' copy and deserves a check; the security page linked above explains how to tell a genuine file from a fake one.

What is the difference between kernel32.dll and KernelBase.dll?

kernel32.dll is the older library that programs link to for basic Windows functions. Since Windows 7 much of its code lives in KernelBase.dll, and kernel32.dll passes many calls on to it. Programs keep calling kernel32.dll as before, which is why a crash can show KernelBase.dll even though the program never names it.

Related guides

Fix

How to fix KernelBase.dll causes application crashes in Windows?

Fix

How to fix Chrome.exe application error in Windows?

Fix

How to fix error code 0xe06d7363 on Windows?

Fix

How to fix Windows application error 0xe0434352?

Sources

File data read on October 14, 2026.

About the authoruGetFix Editorial TeamEditorial team

The editors who write and check uGetFix guides and reference pages. File facts are read from Microsoft's own installers and documentation, and every page shows the date its data was read.

Questions and experiences

Ask about this page: members and our editors answer. Reading is open; writing needs a free account.

0 comments

…

4,322 members already hereThey read, write, comment and vote. 0 verified · 31 joined this year
All membersJoin