cmd.exe crashes (access violation) when launching winget.exe

[davferx]

Relevant area(s)

WinGet CLI

Relevant command(s)

winget list

Brief description of your issue

Bug: cmd.exe crashes (access violation) when launching winget.exe

Summary

Running any winget command from cmd.exe crashes the entire console window (cmd.exe itself faults with 0xc0000005, not winget.exe). The same underlying failure surfaces in PowerShell as:

ResourceUnavailable: Program 'winget.exe' failed to run: Object reference not set to an instance of an object.

winget's own output (e.g. v1.29.280) prints successfully before the crash — the fault happens during process launch/teardown handling in the parent shell, not inside winget's actual logic.

Environment

• Windows 11, cmd.exe version 10.0.26100.8737
• App Installer / winget v1.29.280 (Microsoft.DesktopAppInstaller_1.29.280.0_x64__8wekyb3d8bbwe)
• Package registration status: Ok (Get-AppxPackage reports healthy)

Steps to reproduce

1. Open a fresh cmd.exe window (not a subshell — e.g. Win+R → cmd)
2. Run winget --version
3. Console window closes/crashes immediately after output is printed

Isolation performed

• Alias vs. direct path: Crash reproduces identically whether launched via the app execution alias (%LOCALAPPDATA%\Microsoft\WindowsApps\winget.exe) or the real binary directly (C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.29.280.0_x64__...\winget.exe). Rules out the alias stub as the cause.
• Other packaged aliases unaffected: wt -v and wsl --status (both app-execution-alias launches of packaged apps) run with no error. Rules out a general alias/MSIX launch problem on this machine.
• Other exe in the same package unaffected: WindowsPackageManagerServer.exe (same package, different entry point) launches without crashing the shell. Isolates the fault to the winget.exe application entry specifically, not the package as a whole.
• Package re-registration did not fix it: Add-AppxPackage -RegisterByFamilyName -MainPackage Microsoft.DesktopAppInstaller_8wekyb3d8bbwe successfully restored a manually-deleted alias stub, and winget runs — but the crash is unchanged.
• DISM / SFC: clean.
• Version bisection (1.28.240 vs 1.29.280): Rolling back to version 1.28.240 did not help.

Crash details (from WER minidump, !analyze -v)

• Faulting process: cmd.exe, faulting module: cmd.exe (fault is inside cmd's own code, not a third-party DLL — all loaded modules are stock Microsoft System32 components)
• Exception: 0xC0000005 (access violation), read from address 0x0
• Faulting function: cmd!ExecPgm+0x919
• Call stack: cmd!main → cmd!__scrt_common_main_seh → cmd!Dispatch → cmd!FindFixAndRun → cmd!ECWork → cmd!ExecPgm (crash)
• Faulting instruction: cmp word ptr [rdx+rcx*2], bx with rdx=0, rcx=0 — a null pointer used as a string/array base during what appears to be extension or alias resolution while launching the target program
• Modules loaded in the crashing process include the app-execution-alias / MSIX activation stack (apisethost.appexecutionalias.dll, AppXAllUserStore.dll, windows.staterepositoryclient.dll, windows.staterepositorycore.dll, Windows.StateRepositoryPS.dll, container.dll, daxexec.dll, capauthz.dll), confirming cmd.exe was in the middle of packaged-app activation logic at the time of the fault

Suspected cause

Something specific to the winget.exe application entry in the 1.29.280 package manifest (new in this release: WindowsPackageManagerServer.exe / WindowsPackageManagerMCPServer.exe companion executables) causes cmd.exe's ExecPgm launch path to receive/dereference a null pointer during activation — either a genuine regression in how 1.29.280 declares this entry, or damaged State Repository rows for this specific package entry on this machine. Not yet distinguished; see bisection step above.

Prior art / related (not exact matches)

• microsoft/winget-cli#4988 — same PowerShell ResourceUnavailable / NativeCommandFailed wrapper, different inner error ("file cannot be accessed")
• microsoft/winget-cli#4991 — winget launch broken after a Windows Update, faulting component was svchost.exe_AppXSvc
• microsoft/winget-cli#2025 — winget silently failing via alias but working via direct package path; intermittent, "may be more of a problem with Windows than winget"

No report found matching this exact signature (cmd.exe itself crashing with a null-pointer access violation in ExecPgm when launching winget).

Command Outputs

• Output of Get-AppxPackage Microsoft.DesktopAppInstaller | fl *

Name                   : Microsoft.DesktopAppInstaller
Publisher              : CN=Microsoft Corporation, O=Microsoft Corporation, L=Redmond, S=Washington, C=US
PublisherId            : 8wekyb3d8bbwe
Architecture           : X64
ResourceId             : 
Version                : 1.28.240.0
PackageFamilyName      : Microsoft.DesktopAppInstaller_8wekyb3d8bbwe
PackageFullName        : Microsoft.DesktopAppInstaller_1.28.240.0_x64__8wekyb3d8bbwe
InstallLocation        : C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.28.240.0_x64__8wekyb3d8bbwe
IsFramework            : False
PackageUserInformation : {}
IsResourcePackage      : False
IsBundle               : False
IsDevelopmentMode      : False
NonRemovable           : True
Dependencies           : {Microsoft.WindowsAppRuntime.1.8_8000.921.1539.0_x64__8wekyb3d8bbwe, Microsoft.VCLibs.140.00_14.0.33519.0_x64__8wekyb3d8bbwe, Microsoft.VCLibs.140.00.UWPDesktop_14.0.33728.0_x64__8wekyb3d8bbwe, Microsoft.DesktopAppInstaller_1.28.240.0_neutral_split.scale-125_8wekyb3d8bbwe}
IsPartiallyStaged      : False
SignatureKind          : Store
Capabilities           : {internetClient, privateNetworkClientServer, documentsLibrary, packageManagement…}
Status                 : Ok

• Full !analyze -v output

0:000> !analyze -v
*******************************************************************************
*                                                                             *
*                        Exception Analysis                                   *
*                                                                             *
*******************************************************************************


KEY_VALUES_STRING: 1

    Key  : AV.Dereference
    Value: NullPtr

    Key  : AV.Type
    Value: Read

    Key  : Analysis.CPU.mSec
    Value: 187

    Key  : Analysis.Elapsed.mSec
    Value: 228

    Key  : Analysis.IO.Other.Mb
    Value: 62

    Key  : Analysis.IO.Read.Mb
    Value: 13

    Key  : Analysis.IO.Write.Mb
    Value: 114

    Key  : Analysis.Init.CPU.mSec
    Value: 3375

    Key  : Analysis.Init.Elapsed.mSec
    Value: 3117262

    Key  : Analysis.Memory.CommitPeak.Mb
    Value: 145

    Key  : Analysis.Version.DbgEng
    Value: 10.0.29617.1000

    Key  : Analysis.Version.Description
    Value: 10.2604.29.1 amd64fre

    Key  : Analysis.Version.Ext
    Value: 1.2604.29.1

    Key  : Failure.Bucket
    Value: INVALID_POINTER_READ_c0000005_cmd.exe!ExecPgm

    Key  : Failure.Exception.Code
    Value: 0xc0000005

    Key  : Failure.Exception.IP.Address
    Value: 0x7ff764934059

    Key  : Failure.Exception.IP.Module
    Value: cmd

    Key  : Failure.Exception.IP.Offset
    Value: 0x24059

    Key  : Failure.Hash
    Value: {cf80c8be-0ee9-4c36-40e3-a03dff534884}

    Key  : Failure.ProblemClass.Primary
    Value: INVALID_POINTER_READ

    Key  : Faulting.IP.Type
    Value: Paged

    Key  : Timeline.OS.Boot.DeltaSec
    Value: 2741

    Key  : Timeline.Process.Start.DeltaSec
    Value: 40

    Key  : WER.OS.Branch
    Value: ge_release

    Key  : WER.OS.Version
    Value: 10.0.26100.1

    Key  : WER.Process.Version
    Value: 10.0.26100.8737


FILE_IN_CAB:  cmd.exe_260716_162907.dmp

COMMENT:  
*** "C:\Users\davfe\AppData\Local\Microsoft\WindowsApps\procdump.exe" -e -ma 29332
*** Unhandled exception: C0000005.ACCESS_VIOLATION

NTGLOBALFLAG:  0

APPLICATION_VERIFIER_FLAGS:  0

CONTEXT:  (.ecxr)
rax=0000000000000628 rbx=0000000000000000 rcx=0000000000000000
rdx=0000000000000000 rsi=0000000000000001 rdi=ffffffffffffffff
rip=00007ff764934059 rsp=000000196570f410 rbp=0000000000000000
 r8=000000196570f298  r9=0000000000000000 r10=0000000000000000
r11=0000000000000246 r12=0000000000000000 r13=0000000000000000
r14=00007ff7649553a0 r15=0000000000000000
iopl=0         nv up ei pl zr na pe nc
cs=0033  ss=002b  ds=002b  es=002b  fs=0053  gs=002b             efl=00010244
cmd!ExecPgm+0x919:
00007ff7`64934059 66391c4a        cmp     word ptr [rdx+rcx*2],bx ds:00000000`00000000=????
Resetting default scope

EXCEPTION_RECORD:  (.exr -1)
ExceptionAddress: 00007ff764934059 (cmd!ExecPgm+0x0000000000000919)
   ExceptionCode: c0000005 (Access violation)
  ExceptionFlags: 00000000
NumberParameters: 2
   Parameter[0]: 0000000000000000
   Parameter[1]: 0000000000000000
Attempt to read from address 0000000000000000

PROCESS_NAME:  cmd.exe

READ_ADDRESS:  0000000000000000 

ERROR_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%p referenced memory at 0x%p. The memory could not be %s.

EXCEPTION_CODE_STR:  c0000005

EXCEPTION_PARAMETER1:  0000000000000000

EXCEPTION_PARAMETER2:  0000000000000000

STACK_TEXT:  
00000019`6570f410 00007ff7`6491f150     : 0000019a`d222ef90 0000019a`d222ef90 0000019a`d1df8c50 0000019a`d1e35670 : cmd!ExecPgm+0x919
00000019`6570f6c0 00007ff7`64918d62     : 0000019a`d1df8c50 00000000`00000001 00000000`00000000 0000019a`d1df8c50 : cmd!ECWork+0xac
00000019`6570f960 00007ff7`6491eba3     : 00000000`00000000 0000019a`d1df8c50 00000000`00000001 00000000`00000000 : cmd!FindFixAndRun+0x2b2
00000019`6570fe00 00007ff7`64944e6a     : 00000019`6570ff00 0000019a`d1df8c50 00000000`00000000 00000000`00000000 : cmd!Dispatch+0x163
00000019`6570fea0 00007ff7`64937b3b     : 0000019a`d1de7b40 00000000`00000000 0000019a`d1df0d40 00000000`00000000 : cmd!main+0x322
00000019`6570ff20 00007ff8`869be957     : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : cmd!__scrt_common_main_seh+0x10b
00000019`6570ff60 00007ff8`86d8ad6c     : 00000000`00000000 00000000`00000000 000004f0`fffffb30 000004d0`fffffb30 : kernel32!BaseThreadInitThunk+0x17
00000019`6570ff90 00000000`00000000     : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : ntdll!RtlUserThreadStart+0x2c


STACK_COMMAND: ~0s; .ecxr ; kb

IP_IN_PAGED_CODE: 
cmd!ExecPgm+919
00007ff7`64934059 66391c4a        cmp     word ptr [rdx+rcx*2],bx

SYMBOL_NAME:  cmd!ExecPgm+919

MODULE_NAME: cmd

IMAGE_NAME:  cmd.exe

FAILURE_BUCKET_ID:  INVALID_POINTER_READ_c0000005_cmd.exe!ExecPgm

OS_VERSION:  10.0.26100.1

BUILDLAB_STR:  ge_release

OSPLATFORM_TYPE:  x64

OSNAME:  Windows 10

IMAGE_VERSION:  10.0.26100.8737

FAILURE_ID_HASH:  {cf80c8be-0ee9-4c36-40e3-a03dff534884}

Followup:     MachineOwner
---------

Steps to reproduce

Steps to reproduce

1. Open a fresh cmd.exe window (not a subshell — e.g. Win+R → cmd)
2. Run winget --version
3. Console window closes/crashes immediately after output is printed

Expected behavior

cmd.exe does not crash

Actual behavior

cmd.exe crashes

Environment

## Environment
- Windows 11, cmd.exe version 10.0.26100.8737
- App Installer / winget v1.29.280 (`Microsoft.DesktopAppInstaller_1.29.280.0_x64__8wekyb3d8bbwe`)
- Package registration status: `Ok` (`Get-AppxPackage` reports healthy)

[Kobi-Blade]

Cannot replicate issue, is working fine on CMD here,

C:\Users\User>winget --version
v1.29.280