Windows 10 emergency update resolves KB5005565 app freezes, crashes

Microsoft has released an emergency fix for freezing and crashing app issues caused by September's KB5005565  and KB5005101 cumulative updates.

With the release of the Windows 10 KB5005101 preview update and the KB5005565 cumulative update, Microsoft states that users may have experienced app freezes, app crashes, and the inability to launch an application.

These issues only affected users utilizing the Microsoft Exploit Protection Export Address Filtering (EAF) feature, which is used to detect dangerous operations used by malicious code or exploit modules.

"After installing KB5005101 or a later update on devices using Microsoft Exploit Protection Export Address Filtering (EAF), you might have issues with some applications," explained Microsoft.

"You might be experiencing this issue if apps fail to open, fail to open files, or you might receive a white window when attempting to login."

Microsoft has rolled out a fix using the Known Issue Rollback (KIR) feature, distributed to Windows 10 devices using Windows Update.

"This issue is resolved using Known Issue Rollback (KIR). Please note that it might take up to 24 hours for the resolution to propagate automatically to consumer devices and non-managed business devices. Restarting your Windows device might help the resolution apply to your device faster."

For enterprise users or those who wish to receive the update sooner, you can also install various group policies or add Registry keys to install the fix.

Microsoft has released the following group policies, which users can install to apply the fix. It is critical that users only install the group policy associated with a device's version of Windows.

• Windows Server 2022
• Windows 10, version 2004, Windows 10, version 20H2 and Windows 10, version 21H1
• Windows 10, version 1909
• Windows 10, version 1809, Windows Server 2019

Windows users can also install the fix immediately by running one of the following commands from a Windows 10 elevated command prompt. Like the registry policies, only run the command associated with your version of Windows.

Windows Sever 2022:
reg add HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Policies\Microsoft\FeatureManagement\Overrides /v 2801335948 /t REG_DWORD /d 0 /f

Windows 10, version 2004, Windows 10, version 20H2 and Windows 10, version 21H1:
reg add HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Policies\Microsoft\FeatureManagement\Overrides /v 2767781516 /t REG_DWORD /d 0 /f

Windows 10, version 1909:
reg add HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Policies\Microsoft\FeatureManagement\Overrides /v 928713355 /t REG_DWORD /d 0 /f

Windows 10, version 1809, Windows Server 2019:
reg add HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Policies\Microsoft\FeatureManagement\Overrides /v 2371422858 /t REG_DWORD /d 0 /f

Resolved using the Known Issue Rollback feature

When Microsoft releases new updates to fix known bugs, the new code may cause further issues in Windows 10.

If Windows telemetry and diagnostics indicate that a large audience of Windows 10 users are affected by a new issue, Microsoft can release a Known Issue Rollback (KIR) fix to disable the new code causing the issues, as illustrated below.

In the past, Microsoft has used Known Issue Rollout fixes to resolve printing issues and performance issues while gaming. 

While these fixes are distributed via Windows Update, they are not delivered as an actual update. Instead, they are deployed by creating Windows Registry entries that disable changes made in previous updates.

Microsoft says that Known Issue Rollout fixes are usually installed within 24 hours and that restarting the computer may speed up this process.