CXamlIslandRoot::GetScreenOffset called from wrong thread on cross-process UIA query causes fatal crash (0xc000027b / RPC_E_WRONG_THREAD)

Author: adarei1Created Jun 2, 2026Updated Sep 30, 2026

Labelsbugarea-Islandsteam-Core

Describe the bug

CXamlIslandRoot::GetScreenOffset is invoked from the UIA I/O thread when a cross-process UIA client queries a WinUI 3 window. This method has a hard requirement to be called on the UI thread. WinUI 3 does not marshal the call or return a graceful error — it throws RPC_E_WRONG_THREAD (0x8001010e) as a stowed exception and immediately calls RaiseFailFastException, terminating the process with 0xc000027b (STATUS_FAIL_FAST_EXCEPTION).

The faulting code is in XamlIslandRoot.cpp at commit 978ab6363339e6219c0c4eba5c7339d282f17d09 line 1251. We have confirmed through crash dump analysis that this commit is present and unfixed in Microsoft.WindowsAppSDK 2.0.1, producing an identical FAILURE_ID_HASH: {724eb956-8a49-f327-47eb-207d812dff91}.

Why is this important?

Any WinUI 3 app is silently vulnerable to being crashed by any cross-process UIA client running on the same machine — including Windows-inbox accessibility tools, screen readers, corporate EDR/endpoint agents, and other background processes the user may not even be aware of. The crash is instantaneous, non-recoverable, and bypasses all managed exception handlers. There is no way to defend against it from application code.

Steps to reproduce the bug

We do not have a confirmed minimal standalone repro. In our production WinUI 3 app (which uses ExtendsContentIntoTitleBar = true and a custom TitleBar control), the crash is triggered reliably by opening Accessibility Insights for Windows in Live Inspect mode and hovering over the app window body. The crash also occurs automatically within 8–13 seconds of the app launching on one specific machine, suggesting a background process is making cross-process UIA queries on window appearance.

The trigger is any cross-process UIA operation against the window — either ElementFromPoint (causing CrossProcess_DrillForPointOrFocus) or get_BoundingRectangle (causing CrossProcess_GetPropertiesAndPatterns).

Actual behavior

App process terminates immediately with no user-visible error. Faulting stack:

uiautomationcore!OverlappedIOManager::StaticIoThreadProc uiautomationcore!ChannelBasedServerConnection::OnData uiautomationcore!UiaNode::CrossProcess_DrillForPointOrFocus uiautomationcore!RemoteUiaNodeStub::Incoming_DrillForPointOrFocus uiautomationcore!UiaNode::ProviderDrillForPointOrFocus Microsoft_UI_Xaml!CUIAWindow::ElementProviderFromPoint Microsoft_UI_Xaml!CUIAWindow::TransformScreenToClient Microsoft_UI_Xaml!UIAHostEnvironmentInfo::UiaSpaceToGlobalSpace Microsoft_UI_Xaml!CXamlIslandRoot::GetScreenOffset+0xe7 ← crash

FAILURE_BUCKET_ID: STOWED_EXCEPTION_8001010e_Microsoft.UI.Xaml.dll!CXamlIslandRoot::GetScreenOffset

Expected behavior

When GetScreenOffset is called from a thread other than the UI thread, WinUI 3 should either marshal the call to the UI thread, return a safe default value, or return an error code — not terminate the process.

Screenshots

No response

NuGet package version

Microsoft.WindowsAppSDK 2.0.1

Windows version

Windows 11 (24H2): Build 26100

Additional context

************* Path validation summary ************** Response Time (ms) Location Deferred srv*

************* Preparing the environment for Debugger Extensions Gallery repositories ************** ExtensionRepository : Implicit UseExperimentalFeatureForNugetShare : true AllowNugetExeUpdate : true NonInteractiveNuget : true AllowNugetMSCredentialProviderInstall : true AllowParallelInitializationOfLocalRepositories : true EnableRedirectToChakraJsProvider : false

-- Configuring repositories ----> Repository : LocalInstalled, Enabled: true ----> Repository : UserExtensions, Enabled: true

Preparing the environment for Debugger Extensions Gallery repositories completed, duration 0.000 seconds

************* Waiting for Debugger Extensions Gallery to Initialize ************** ..

Waiting for Debugger Extensions Gallery to Initialize completed, duration 1.609 seconds ----> Repository : UserExtensions, Enabled: true, Packages count: 0 ----> Repository : LocalInstalled, Enabled: true, Packages count: 46

Loading Dump File [C:\Users\adarei1\Downloads\Koala.UI.exe.27512.dmp] User Mini Dump File with Full Memory : Only application data is available

************* Path validation summary ************** Response Time (ms) Location Deferred srv* Symbol search path is: srv* Executable search path is: Windows 10 Version 26100 MP (14 procs) Free x64 Product: WinNt, suite: SingleUserTS Edition build lab: 26100.1.amd64fre.ge_release.240331-1435 Debug session time: Wed May 27 17:18:36.000 2026 (UTC + 1:00) System Uptime: 1 days 12:47:30.724 Process Uptime: 0 days 0:00:11.000 ................................................................ ................................................................ ................................................................ ................................................................ .................. Loading unloaded module list . This dump file has an exception of interest stored in it. The stored exception information can be accessed via .ecxr (6b78.52dc): Unknown exception - code c000027b (first/second chance not available)

+------------------------------------------------------------------------+ | This target supports Hardware-enforced Stack Protection. A HW based | | "Shadow Stack" may be available to assist in debugging and analysis. | | See aka.ms/userhsp for more info. | | | | dps @ssp | | | +------------------------------------------------------------------------+

For analysis of this file, run !analyze -v KERNELBASE!RaiseFailFastException+0x188: 00007ffd`c6700318 0f1f440000 nop dword ptr [rax+rax] 0:039> !analyze -v ................................................................ ................................................................ ................................................................ ................................................................ ................................................................ ......................................... Loading unloaded module list . ClrmaManagedAnalysis::AssociateClient Loading extension C:\Program Files\WindowsApps\Microsoft.WinDbg_1.2603.20001.0_x64__8wekyb3d8bbwe\amd64\winext\sos\extensions\Microsoft.Diagnostics.DataContractReader.dll Loading extension C:\Program Files\WindowsApps\Microsoft.WinDbg_1.2603.20001.0_x64__8wekyb3d8bbwe\amd64\winext\sos\extensions\Microsoft.Diagnostics.DataContractReader.Extension.dll Loading extension C:\Program Files\WindowsApps\Microsoft.WinDbg_1.2603.20001.0_x64__8wekyb3d8bbwe\amd64\winext\sos\extensions\Microsoft.Diagnostics.DebuggerCommands.dll AssociateClient trying managed CLRMA AssociateClient got managed CLRMA service AssociateClient trying DAC CLRMA

                   Exception Analysis                                   *

ClrmaManagedAnalysis::GetThread 52dc ClrmaThread::Initialize 52dc ClrmaThread::Initialize FAILED managed thread not found ~ClrmaThread ClrmaManagedAnalysis::get_ProviderName ClrmaManagedAnalysis::GetThread ffffffff ClrmaThread::Initialize 52dc ClrmaThread::Initialize FAILED managed thread not found ~ClrmaThread DEBUG_FLR_EXCEPTION_CODE(8001010e) and the ".exr -1" ExceptionCode(c000027b) don't match

KEY_VALUES_STRING: 1

Key  : Analysis.CPU.mSec
Value: 2531

Key  : Analysis.Elapsed.mSec
Value: 3189

Key  : Analysis.IO.Other.Mb
Value: 0

Key  : Analysis.IO.Read.Mb
Value: 3

Key  : Analysis.IO.Write.Mb
Value: 0

Key  : Analysis.Init.CPU.mSec
Value: 1156

Key  : Analysis.Init.Elapsed.mSec
Value: 19768

Key  : Analysis.Memory.CommitPeak.Mb
Value: 433

Key  : Analysis.Version.DbgEng
Value: 10.0.29547.1002

Key  : Analysis.Version.Description
Value: 10.2602.27.2 amd64fre

Key  : Analysis.Version.Ext
Value: 1.2602.27.2

Key  : CLR.Engine
Value: CORECLR

Key  : CLR.Version
Value: 10.0.526.15411

Key  : Failure.Bucket
Value: STOWED_EXCEPTION_8001010e_Microsoft.UI.Xaml.dll!CXamlIslandRoot::GetScreenOffset

Key  : Failure.Exception.Code
Value: 0x8001010e

Key  : Failure.Exception.IP.Address
Value: 0x7ffcda92c82d

Key  : Failure.Exception.IP.Module
Value: Microsoft_UI_Xaml

Key  : Failure.Exception.IP.Offset
Value: 0x3ac82d

Key  : Failure.Hash
Value: {724eb956-8a49-f327-47eb-207d812dff91}

Key  : Failure.ProblemClass.Primary
Value: STOWED_EXCEPTION

Key  : Failure.Source.FileLine
Value: 1251

Key  : Failure.Source.FilePath
Value: C:\__w\1\s\dxaml\\\xcp\core\core\elements\XamlIslandRoot.cpp

Key  : Failure.Source.SourceServerCommand
Value: powershell -command "Invoke-WebRequest 'raw.githubusercontent.com/microsoft/microsoft-ui-xaml/978ab6363339e6219c0c4eba5c7339d282f17d09/src/dxaml/xcp/core/core/elements/XamlIslandRoot.cpp' -OutFile '"C:\ProgramData\Dbg\src\TFS_COMMIT\d95f76bb\src\dxaml\\\xcp\core\core\elements\XamlIslandRoot.cpp"'"

Key  : Faulting.IP.Type
Value: Paged

Key  : Timeline.OS.Boot.DeltaSec
Value: 132450

Key  : Timeline.Process.Start.DeltaSec
Value: 11

Key  : WER.OS.Branch
Value: ge_release

Key  : WER.OS.Version
Value: 10.0.26100.1

Key  : WER.Process.Version
Value: 1.0.148.0

FILE_IN_CAB: Koala.UI.exe.27512.dmp

NTGLOBALFLAG: 0

APPLICATION_VERIFIER_FLAGS: 0

CONTEXT: (.ecxr) rax=0000004ab717e470 rbx=0000004ab717ea50 rcx=0000004ab717e470 rdx=0000004ab717e920 rsi=00000250132e0301 rdi=0000004ab717e470 rip=00007ffdc6700318 rsp=0000004ab717e390 rbp=0000004ab717e490 r8=0000000000000000 r9=0000004ab717e8e0 r10=00007ffdc69f0000 r11=00007ffdc6add795 r12=00000000000004b1 r13=0000000080070057 r14=0000000000000001 r15=0000000000000002 iopl=0 nv up ei pl nz na pe nc cs=0033 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00000204 KERNELBASE!RaiseFailFastException+0x188: 00007ffd`c6700318 0f1f440000 nop dword ptr [rax+rax] Resetting default scope

EXCEPTION_RECORD: (.exr -1) ExceptionAddress: 00007ffcda92c82d (Microsoft_UI_Xaml!FailFastWithStowedExceptions+0x0000000000000061) ExceptionCode: c000027b ExceptionFlags: 00000001 NumberParameters: 2 Parameter[0]: 00000250132e0360 Parameter[1]: 0000000000000001

PROCESS_NAME: Koala.UI.dll

ERROR_CODE: (NTSTATUS) 0xc000027b - An application-internal exception has occurred.

EXCEPTION_CODE_STR: 8001010e

EXCEPTION_PARAMETER1: 00000250132e0360

EXCEPTION_PARAMETER2: 0000000000000001

FAULTING_THREAD: ffffffff

STACK_TEXT:
0000025013672d80 00007ffcda971fcb Microsoft_UI_Xaml!CXamlIslandRoot::GetScreenOffset+0xe7 0000025013672d88 00007ffcdaa5030f Microsoft_UI_Xaml!UIAHostEnvironmentInfo::GlobalSpaceToUiaSpace+0x5f 0000025013672d90 00007ffcdaa5027f Microsoft_UI_Xaml!UIAHostEnvironmentInfo::GlobalSpaceToUiaSpace+0x33 0000025013672d98 00007ffcdaa48bb0 Microsoft_UI_Xaml!CUIAWindow::get_BoundingRectangle+0x120 0000025013672da0 00007ffd7f1eac02 uiautomationcore!UiaNode::GetBoundingRectangleInScreenCoordinates+0x116 0000025013672da8 00007ffd7f1e9d50 uiautomationcore!UiaNode::ProviderGetPropertyValue+0xa90 0000025013672db0 00007ffd7f1e8509 uiautomationcore!UiaNode::ProviderGetPropertiesAndPatterns+0x105 0000025013672db8 00007ffd7f1e83da uiautomationcore!InProcClientAPIStub::UiaNode_GetPropertiesAndPatterns+0x6a 0000025013672dc0 00007ffd7f31d42b uiautomationcore!ComInvoker::CallTarget+0x1eb 0000025013672dc8 00007ffd7f20889c uiautomationcore!InProcClientAPIStub::InvokeInProcAPI+0x44 0000025013672dd0 00007ffd7f209283 uiautomationcore!UiaNode::CrossProcess_GetPropertiesAndPatterns+0x593 0000025013672dd8 00007ffd7f1bb5bf uiautomationcore!RemoteUiaNodeStub::Incoming_GetPropertiesAndPatterns+0x3ef 0000025013672de0 00007ffd7f2629e2 uiautomationcore!InvokeElementMethodOnCorrectContext_Callback+0x252 0000025013672de8 00007ffd7f31d42b uiautomationcore!ComInvoker::CallTarget+0x1eb 0000025013672df0 00007ffd7f27433b uiautomationcore!anonymous namespace'::ProcessIncomingRequestNoThrow+0x5eb 0000025013672df8 00007ffd7f3554eb uiautomationcore!ProcessIncomingRequest+0x37 0000025013672e00 00007ffd7f31cd0f uiautomationcore!ChannelBasedServerConnection::ProcessOneMessage+0x5f 0000025013672e08 00007ffd7f1f7ddb uiautomationcore!ChannelBasedServerConnection::OnData+0x20b 0000025013672e10 00007ffd7f291f85 uiautomationcore!ReadWriteChannelInfo::Service+0x2b5 0000025013672e18 00007ffd7f23f199 uiautomationcore!OverlappedIOManager::IoThreadProc+0x69 0000025013672e20 00007ffd7f3141c9 uiautomationcore!OverlappedIOManager::StaticIoThreadProc+0x9 0000025013672e28 00007ffdc837e8d7 kernel32!BaseThreadInitThunk+0x17 0000025013672e30 00007ffd`c9dac3fc ntdll!RtlUserThreadStart+0x2c

IP_IN_PAGED_CODE: Microsoft_UI_Xaml!FailFastWithStowedExceptions+61 [C:__w\1\s\dxaml\\xcp\components\base\ErrorContext.cpp @ 1508] 00007ffc`da92c82d 488b5c2430 mov rbx,qword ptr [rsp+30h]

FAULTING_SOURCE_LINE: C:__w\1\s\dxaml\\xcp\core\core\elements\XamlIslandRoot.cpp

FAULTING_SOURCE_FILE: C:__w\1\s\dxaml\\xcp\core\core\elements\XamlIslandRoot.cpp

FAULTING_SOURCE_LINE_NUMBER: 1251

FAULTING_SOURCE_SRV_COMMAND: powershell -command "Invoke-WebRequest 'https://raw.githubusercontent.com/microsoft/microsoft-ui-xaml/978ab6363339e6219c0c4eba5c7339d282f17d09/src/dxaml/xcp/core/core/elements/XamlIslandRoot.cpp' -OutFile '"C:\ProgramData\Dbg\src\TFS_COMMIT\d95f76bb\src\dxaml\\xcp\core\core\elements\XamlIslandRoot.cpp"'"

FAULTING_SOURCE_CODE:
No source found for 'C:__w\1\s\dxaml\\xcp\core\core\elements\XamlIslandRoot.cpp'

SYMBOL_NAME: Microsoft_UI_Xaml!CXamlIslandRoot::GetScreenOffset+e7

MODULE_NAME: Microsoft_UI_Xaml

IMAGE_NAME: Microsoft.UI.Xaml.dll

STACK_COMMAND: .echo *** Stowed Exception v2 ***; .exr -1; dpp 0x250132e0360 L0x1; dt 0x25013673da0 combase!STOWED_EXCEPTION_INFORMATION_V2 -r; dps 0x25013672d80 L0x17 ; ** Pseudo Context ** StowedPseudo ** Value: 3 ** ; kb

FAILURE_BUCKET_ID: STOWED_EXCEPTION_8001010e_Microsoft.UI.Xaml.dll!CXamlIslandRoot::GetScreenOffset

OS_VERSION: 10.0.26100.1

BUILDLAB_STR: ge_release

OSPLATFORM_TYPE: x64

OSNAME: Windows 10

IMAGE_VERSION: 3.2.0.0

FAILURE_ID_HASH: {724eb956-8a49-f327-47eb-207d812dff91}

Followup: MachineOwner

CLRMAReleaseInstance

Source: microsoft/microsoft-ui-xaml

View original on GitHub View discussion on GitHub