Baike.dev
All toolsOnline toolsAI codingTrendingOpen sourceNewsSubmit
Log in
Back to tool/Back to issues
#50840·PowerToys

PDF Preview Handler crashes (0xe0434352) when Explorer previews a PDF while another app's Medium-IL preview host already uses it

Author: martinhoessCreated Sep 28, 2026Updated Sep 28, 2026
LabelsProduct-File ExplorerNeeds-TriageNeeds-Team-Response

Microsoft PowerToys version and release channel

0.101.2362.0 - Stable

Installation method

PowerToys auto-update

Area(s) with issue?

File Explorer: Preview Pane

Steps to reproduce

  1. Make sure no prevhost.exe is running (close Explorer windows and apps that show file previews).
  2. Preview a PDF in an application that hosts preview handlers at Medium integrity level. I used the preview pane of Everything 1.5a; its prevhost.exe runs at Medium IL.
  3. Keep that preview open and select a PDF in File Explorer with the preview pane enabled.

The order matters. If Explorer previews a PDF first, both previews work side by side until every preview host has exited.

✔️ Expected Behavior

The Explorer preview pane shows the PDF, no matter whether another application previews a PDF at the same time.

❌ Actual Behavior

Image

The PowerToys.PdfPreviewHandler.exe started for Explorer dies with an unhandled .NET exception and Explorer shows no preview. Windows Error Reporting is disabled on this machine, so Windows shows the legacy dialog instead of a WER report (translated from German):

PowerToys.PdfPreviewHandler.exe - Application Error The exception unknown software exception (0xe0434352) occurred in the application at location 0x00007FFD9D7041CA.

The PdfPrevHandler log of the Explorer preview host shows Failed to create resize event for PdfPreviewHandler on every resize (log excerpt below).

Additional Information

Windows 11 Pro 25H2, build 26200.9457

Two preview hosts with different integrity levels

While the crash happens, two prevhost.exe processes have PowerToys.PdfPreviewHandlerCpp.dll loaded:

Client prevhost.exe started for IL Parent window of the handler exe
Everything {A5A41CC7-02CB-41D4-8C9B-9087040D6098} (PowerToys PDF handler) Medium EVERYTHING_PREVIEW_HANDLER (Everything.exe)
Explorer preview pane {914FEED8-267A-4BAA-B8AA-21E233792679} ("Microsoft Preview Creator", shell32.dll) Low Shell Preview Extension Host Previewer (prevhost.exe)

Root cause

Both instances use the same session-wide named event Local\PowerToysPdfPreviewResizeEvent-5a2f162a-f728-45fe-8bda-ef3d5e434ce7:

  • PdfPreviewHandler::PdfPreviewHandler() calls CreateEvent(nullptr, false, false, PDF_PREVIEW_RESIZE_EVENT) with the default security descriptor.
  • PowerToys.PdfPreviewHandler.exe opens it in Common.UI.NativeEventWaiter.WaitForEventLoop with new EventWaitHandle(false, EventResetMode.AutoReset, eventName). That runs on a background thread without try/catch.

When the Medium-IL host creates the event first, the event gets the default Medium mandatory label. The Low-IL instance is then denied access by the no-write-up policy:

  • C++ side: CreateEvent returns NULL, so the handler logs Failed to create resize event and continues.
  • .NET side: the EventWaitHandle constructor throws UnauthorizedAccessException on the background thread. The exception is unhandled and the process terminates with 0xe0434352.

When the Low-IL host creates the event first, it gets a Low label and the Medium instance can open it. That is why the order matters. The event lives as long as any process holds a handle, and the C++ handler never closes m_resizeEvent (the destructor has no CloseHandle), so every preview host keeps it alive until it exits.

Verified on the affected machine

repro-lowil-event.ps1 (below) creates the event in a Medium-IL PowerShell and opens it with an impersonated Low-IL token, the same way NativeEventWaiter does (output translated from German):

low IL: System.UnauthorizedAccessException: Access to the path 'Local\PowerToysPdfPreviewResizeEvent-test-…' is denied.
control, fresh event opened at low IL: OK

While the Everything preview host held the real event (Medium label), opening Local\PowerToysPdfPreviewResizeEvent-5a2f162a-… with a Low-IL token failed the same way; a Medium token worked. No dump or stack trace is available because WER is disabled on this machine.

Still present on main

src/common/Common.UI/NativeEventWaiter.cs and src/modules/previewpane/PdfPreviewHandler/Program.cs are unchanged on main. FileExplorerDllExporter/PreviewHandler.cpp from #50252 still calls CreateEvent(nullptr, false, false, resizeEvent) with a global name and never closes the handle. The other preview handlers (Markdown, SVG, Monaco, G-code, Bgcode, QOI) use the same pattern and are probably affected as well.

Suggested fix

  • Give each handler instance its own event name, for example by passing it to the exe as an argument. That also fixes a second problem of the shared auto-reset event: with two running instances, a resize signal wakes only one of them.
  • Alternatively, create the event with a security descriptor that carries a Low mandatory label (SDDL S:(ML;;NW;;;LW)) so Low and Medium instances can both open it.
  • In NativeEventWaiter, handle a failure to open the event instead of letting the background thread terminate the process.
  • Close m_resizeEvent in the handler's destructor.

Possibly the same cause: #39851 (same dialog, closed because it could not be reproduced).

PdfPrevHandler log, 2026-09-28 (Everything preview host started 11:47:43, Explorer host 11:47:46; Everything preview closed 12:04:08, after that Explorer created the event first)
[2026-09-28 11:46:07.298336] [p-31232] [t-31296] [info] PdfPrevHandler logger is initialized
[2026-09-28 11:46:07.306340] [p-31232] [t-31296] [info] Starting PdfPreviewHandler.exe
[2026-09-28 11:46:18.451961] [p-31232] [t-31296] [info] Unload and terminate .exe
[2026-09-28 11:47:43.678302] [p-23676] [t-31648] [info] PdfPrevHandler logger is initialized
[2026-09-28 11:47:43.683567] [p-23676] [t-31648] [info] Starting PdfPreviewHandler.exe
[2026-09-28 11:47:46.651776] [p-9800] [t-31308] [info] PdfPrevHandler logger is initialized
[2026-09-28 11:47:46.670857] [p-9800] [t-31308] [info] Starting PdfPreviewHandler.exe
[2026-09-28 11:47:46.712000] [p-9800] [t-31308] [error] Failed to create resize event for PdfPreviewHandler
[2026-09-28 11:47:56.610317] [p-9800] [t-31308] [error] Failed to create resize event for PdfPreviewHandler
[2026-09-28 11:47:58.071407] [p-9800] [t-31308] [info] Unload and terminate .exe
[2026-09-28 11:48:11.365442] [p-9800] [t-31308] [info] Starting PdfPreviewHandler.exe
[2026-09-28 11:48:14.164055] [p-9800] [t-31308] [info] Unload and terminate .exe
[2026-09-28 11:48:14.179490] [p-9800] [t-31308] [info] Starting PdfPreviewHandler.exe
[2026-09-28 11:48:19.009049] [p-9800] [t-31308] [info] Unload and terminate .exe
[2026-09-28 11:48:19.026216] [p-9800] [t-31308] [info] Starting PdfPreviewHandler.exe
[2026-09-28 11:48:27.705707] [p-9800] [t-31308] [info] Unload and terminate .exe
[2026-09-28 11:48:27.724659] [p-9800] [t-31308] [info] Starting PdfPreviewHandler.exe
[2026-09-28 11:48:32.559932] [p-9800] [t-31308] [info] Unload and terminate .exe
[2026-09-28 11:48:32.577964] [p-9800] [t-31308] [info] Starting PdfPreviewHandler.exe
[2026-09-28 11:48:37.258971] [p-9800] [t-31308] [info] Unload and terminate .exe
[2026-09-28 11:48:37.272478] [p-9800] [t-31308] [info] Starting PdfPreviewHandler.exe
[2026-09-28 11:48:38.585306] [p-9800] [t-31308] [info] Unload and terminate .exe
[2026-09-28 11:48:38.603555] [p-9800] [t-31308] [info] Starting PdfPreviewHandler.exe
[2026-09-28 11:48:39.662995] [p-9800] [t-31308] [info] Unload and terminate .exe
[2026-09-28 11:48:39.679570] [p-9800] [t-31308] [info] Starting PdfPreviewHandler.exe
[2026-09-28 11:48:49.503188] [p-9800] [t-31308] [error] Failed to create resize event for PdfPreviewHandler
[2026-09-28 11:48:49.527209] [p-9800] [t-31308] [error] Failed to create resize event for PdfPreviewHandler
[2026-09-28 11:48:49.547049] [p-9800] [t-31308] [error] Failed to create resize event for PdfPreviewHandler
[2026-09-28 11:48:49.568083] [p-9800] [t-31308] [error] Failed to create resize event for PdfPreviewHandler
[2026-09-28 11:48:49.588104] [p-9800] [t-31308] [error] Failed to create resize event for PdfPreviewHandler
[2026-09-28 11:48:49.607814] [p-9800] [t-31308] [error] Failed to create resize event for PdfPreviewHandler
[2026-09-28 11:48:49.628063] [p-9800] [t-31308] [error] Failed to create resize event for PdfPreviewHandler
[2026-09-28 11:48:49.648093] [p-9800] [t-31308] [error] Failed to create resize event for PdfPreviewHandler
[2026-09-28 11:48:49.668788] [p-9800] [t-31308] [error] Failed to create resize event for PdfPreviewHandler
[2026-09-28 11:48:49.689163] [p-9800] [t-31308] [error] Failed to create resize event for PdfPreviewHandler
[2026-09-28 11:48:49.709084] [p-9800] [t-31308] [error] Failed to create resize event for PdfPreviewHandler
[2026-09-28 11:48:49.727667] [p-9800] [t-31308] [error] Failed to create resize event for PdfPreviewHandler
[2026-09-28 11:48:49.745449] [p-9800] [t-31308] [error] Failed to create resize event for PdfPreviewHandler
[2026-09-28 11:48:50.016136] [p-9800] [t-31308] [error] Failed to create resize event for PdfPreviewHandler
[2026-09-28 11:48:50.032000] [p-9800] [t-31308] [error] Failed to create resize event for PdfPreviewHandler
[2026-09-28 11:48:50.051426] [p-9800] [t-31308] [error] Failed to create resize event for PdfPreviewHandler
[2026-09-28 11:48:50.067295] [p-9800] [t-31308] [error] Failed to create resize event for PdfPreviewHandler
[2026-09-28 11:48:50.085284] [p-9800] [t-31308] [error] Failed to create resize event for PdfPreviewHandler
[2026-09-28 11:48:50.104280] [p-9800] [t-31308] [error] Failed to create resize event for PdfPreviewHandler
[2026-09-28 11:48:50.124952] [p-9800] [t-31308] [error] Failed to create resize event for PdfPreviewHandler
[2026-09-28 11:48:50.142238] [p-9800] [t-31308] [error] Failed to create resize event for PdfPreviewHandler
[2026-09-28 11:48:50.160227] [p-9800] [t-31308] [error] Failed to create resize event for PdfPreviewHandler
[2026-09-28 11:48:50.177555] [p-9800] [t-31308] [error] Failed to create resize event for PdfPreviewHandler
[2026-09-28 11:51:03.607006] [p-9800] [t-31308] [info] Unload and terminate .exe
[2026-09-28 11:51:16.384131] [p-9800] [t-31308] [info] Starting PdfPreviewHandler.exe
[2026-09-28 11:51:25.073531] [p-9800] [t-31308] [info] Unload and terminate .exe
[2026-09-28 11:51:25.087490] [p-9800] [t-31308] [info] Starting PdfPreviewHandler.exe
[2026-09-28 12:04:08.322495] [p-23676] [t-31648] [info] Unload and terminate .exe
[2026-09-28 12:04:09.312255] [p-9800] [t-31308] [info] Unload and terminate .exe
[2026-09-28 12:04:09.341387] [p-9800] [t-31308] [info] Starting PdfPreviewHandler.exe
[2026-09-28 12:04:10.656182] [p-9800] [t-31308] [info] Unload and terminate .exe
[2026-09-28 12:04:11.838704] [p-9800] [t-31308] [info] Starting PdfPreviewHandler.exe
[2026-09-28 12:04:12.968618] [p-9800] [t-31308] [info] Unload and terminate .exe
[2026-09-28 12:04:12.983825] [p-9800] [t-31308] [info] Starting PdfPreviewHandler.exe
[2026-09-28 12:04:33.551298] [p-7808] [t-28800] [info] PdfPrevHandler logger is initialized
[2026-09-28 12:04:33.557037] [p-7808] [t-28800] [info] Starting PdfPreviewHandler.exe
[2026-09-28 12:04:35.370261] [p-9800] [t-31308] [info] Unload and terminate .exe
[2026-09-28 12:04:35.394931] [p-9800] [t-31308] [info] Starting PdfPreviewHandler.exe
[2026-09-28 12:04:36.416594] [p-9800] [t-31308] [info] Unload and terminate .exe
[2026-09-28 12:04:36.434105] [p-9800] [t-31308] [info] Starting PdfPreviewHandler.exe
[2026-09-28 12:04:43.696609] [p-7808] [t-28800] [info] Unload and terminate .exe
[2026-09-28 12:04:51.430695] [p-7808] [t-28800] [info] Starting PdfPreviewHandler.exe
[2026-09-28 12:04:53.204496] [p-9800] [t-31308] [info] Unload and terminate .exe
[2026-09-28 12:04:53.231965] [p-9800] [t-31308] [info] Starting PdfPreviewHandler.exe
[2026-09-28 12:04:54.277008] [p-9800] [t-31308] [info] Unload and terminate .exe
[2026-09-28 12:04:54.300786] [p-9800] [t-31308] [info] Starting PdfPreviewHandler.exe
[2026-09-28 12:04:55.591483] [p-9800] [t-31308] [info] Unload and terminate .exe
[2026-09-28 12:04:55.607616] [p-9800] [t-31308] [info] Starting PdfPreviewHandler.exe
[2026-09-28 12:04:56.523253] [p-9800] [t-31308] [info] Unload and terminate .exe
[2026-09-28 12:04:56.539705] [p-9800] [t-31308] [info] Starting PdfPreviewHandler.exe
[2026-09-28 12:04:58.379186] [p-9800] [t-31308] [info] Unload and terminate .exe
[2026-09-28 12:04:58.394993] [p-9800] [t-31308] [info] Starting PdfPreviewHandler.exe
[2026-09-28 12:05:02.366288] [p-9800] [t-31308] [info] Unload and terminate .exe
[2026-09-28 12:05:06.584821] [p-30844] [t-28760] [info] PdfPrevHandler logger is initialized
[2026-09-28 12:05:06.596429] [p-30844] [t-28760] [info] Starting PdfPreviewHandler.exe
[2026-09-28 12:05:09.145868] [p-30844] [t-28760] [info] Unload and terminate .exe
[2026-09-28 12:05:09.164272] [p-30844] [t-28760] [info] Starting PdfPreviewHandler.exe
[2026-09-28 12:05:09.948929] [p-30844] [t-28760] [info] Unload and terminate .exe
[2026-09-28 12:05:09.964481] [p-30844] [t-28760] [info] Starting PdfPreviewHandler.exe
[2026-09-28 12:05:13.435490] [p-30844] [t-28760] [info] Unload and terminate .exe
[2026-09-28 12:05:13.440121] [p-30844] [t-28760] [info] Starting PdfPreviewHandler.exe
[2026-09-28 12:05:14.848967] [p-30844] [t-28760] [info] Unload and terminate .exe
[2026-09-28 12:05:14.864478] [p-30844] [t-28760] [info] Starting PdfPreviewHandler.exe
[2026-09-28 12:05:16.029195] [p-30844] [t-28760] [info] Unload and terminate .exe
[2026-09-28 12:05:16.033993] [p-30844] [t-28760] [info] Starting PdfPreviewHandler.exe
[2026-09-28 12:05:18.940544] [p-30844] [t-28760] [info] Unload and terminate .exe
[2026-09-28 12:05:18.970368] [p-30844] [t-28760] [info] Starting PdfPreviewHandler.exe
[2026-09-28 12:05:19.785124] [p-30844] [t-28760] [info] Unload and terminate .exe
[2026-09-28 12:05:19.792011] [p-30844] [t-28760] [info] Starting PdfPreviewHandler.exe
[2026-09-28 12:05:20.570481] [p-30844] [t-28760] [info] Unload and terminate .exe
[2026-09-28 12:05:20.584700] [p-30844] [t-28760] [info] Starting PdfPreviewHandler.exe
[2026-09-28 12:05:21.746456] [p-30844] [t-28760] [info] Unload and terminate .exe
[2026-09-28 12:05:21.760896] [p-30844] [t-28760] [info] Starting PdfPreviewHandler.exe
[2026-09-28 12:05:22.536715] [p-30844] [t-28760] [info] Unload and terminate .exe
[2026-09-28 12:05:22.550008] [p-30844] [t-28760] [info] Starting PdfPreviewHandler.exe
[2026-09-28 12:05:59.480020] [p-30844] [t-28760] [info] Unload and terminate .exe
[2026-09-28 12:06:17.375941] [p-31536] [t-26744] [info] PdfPrevHandler logger is initialized
[2026-09-28 12:06:17.388473] [p-31536] [t-26744] [info] Starting PdfPreviewHandler.exe
[2026-09-28 12:06:18.653851] [p-31536] [t-26744] [info] Unload and terminate .exe
[2026-09-28 12:06:18.670294] [p-31536] [t-26744] [info] Starting PdfPreviewHandler.exe
[2026-09-28 12:06:19.490628] [p-31536] [t-26744] [info] Unload and terminate .exe
[2026-09-28 12:06:19.507926] [p-31536] [t-26744] [info] Starting PdfPreviewHandler.exe
[2026-09-28 12:06:20.248314] [p-31536] [t-26744] [info] Unload and terminate .exe
[2026-09-28 12:06:20.264129] [p-31536] [t-26744] [info] Starting PdfPreviewHandler.exe
repro-lowil-event.ps1
powershell
# Shows why PowerToys.PdfPreviewHandler.exe running at Low IL cannot open the
# PDF resize event once a Medium-IL process has created it.
# Run in a normal (Medium IL) Windows PowerShell 5.1 or PowerShell 7.
#
#   .\repro-lowil-event.ps1            # uses a fresh test name, always reproduces
#   .\repro-lowil-event.ps1 -RealName  # uses the real PowerToys event name
#                                      # (only meaningful while no prevhost.exe holds it)
param([switch]$RealName)

Add-Type @"
using System; using System.Runtime.InteropServices; using System.Threading;
public static class LowIlProbe {
  [DllImport("advapi32", SetLastError=true)] static extern bool OpenProcessToken(IntPtr h, uint a, out IntPtr t);
  [DllImport("advapi32", SetLastError=true)] static extern bool DuplicateTokenEx(IntPtr t, uint a, IntPtr sa, int lvl, int type, out IntPtr n);
  [DllImport("advapi32", SetLastError=true)] static extern bool ConvertStringSidToSid(string s, out IntPtr sid);
  [DllImport("advapi32", SetLastError=true)] static extern bool SetTokenInformation(IntPtr t, int c, IntPtr info, int len);
  [DllImport("advapi32", SetLastError=true)] static extern bool ImpersonateLoggedOnUser(IntPtr t);
  [DllImport("advapi32")] static extern bool RevertToSelf();
  [DllImport("advapi32")] static extern int GetLengthSid(IntPtr sid);
  [DllImport("kernel32")] static extern IntPtr GetCurrentProcess();

  // Same call as Common.UI.NativeEventWaiter.WaitForEventLoop
  static string Open(string name) {
    try { using (new EventWaitHandle(false, EventResetMode.AutoReset, name)) { return "OK"; } }
    catch (Exception e) { return e.GetType().FullName + ": " + e.Message; }
  }

  public static string OpenAsLowIl(string name) {
    IntPtr tok, dup, sid;
    // TOKEN_DUPLICATE | TOKEN_QUERY | TOKEN_ADJUST_DEFAULT | TOKEN_ASSIGN_PRIMARY
    if (!OpenProcessToken(GetCurrentProcess(), 0x2 | 0x8 | 0x80 | 0x1, out tok)) return "OpenProcessToken failed";
    if (!DuplicateTokenEx(tok, 0x2000000, IntPtr.Zero, 2 /*Impersonation*/, 2 /*TokenImpersonation*/, out dup)) return "DuplicateTokenEx failed";
    ConvertStringSidToSid("S-1-16-4096", out sid); // Low mandatory level
    IntPtr tml = Marshal.AllocHGlobal(IntPtr.Size * 2);
    Marshal.WriteIntPtr(tml, sid);
    Marshal.WriteInt32(tml, IntPtr.Size, 0x20); // SE_GROUP_INTEGRITY
    if (!SetTokenInformation(dup, 25 /*TokenIntegrityLevel*/, tml, IntPtr.Size * 2 + GetLengthSid(sid))) return "SetTokenInformation failed";
    if (!ImpersonateLoggedOnUser(dup)) return "ImpersonateLoggedOnUser failed";
    try { return Open(name); } finally { RevertToSelf(); }
  }
}
"@

$name = if ($RealName) { 'Local\PowerToysPdfPreviewResizeEvent-5a2f162a-f728-45fe-8bda-ef3d5e434ce7' }
        else { 'Local\PowerToysPdfPreviewResizeEvent-test-' + [guid]::NewGuid() }

# 1) Medium-IL process creates the event and keeps it open (like prevhost.exe hosting the handler for a Medium-IL client)
$medium = New-Object System.Threading.EventWaitHandle($false, 'AutoReset', $name)
try {
    # 2) Low-IL code opens the same event (like PowerToys.PdfPreviewHandler.exe started by the Low-IL Explorer preview host)
    "event:  $name"
    "low IL: " + [LowIlProbe]::OpenAsLowIl($name)
}
finally { $medium.Dispose() }

# 3) Other way round: a Low-IL creator gives the event a Low label, Medium can open it
$fresh = 'Local\PowerToysPdfPreviewResizeEvent-test-' + [guid]::NewGuid()
"control, fresh event opened at low IL: " + [LowIlProbe]::OpenAsLowIl($fresh)

Other Software

Everything 1.5.0.1399a (x64) by voidtools, preview pane enabled

Source: microsoft/PowerToys

View original on GitHubView discussion on GitHub