topic Re: Office 365 June build (2606) crashes with Check Point Endpoint 89.10 and 89.21 in Endpoint

Office 365 June build (2606) crashes with Check Point Endpoint 89.10 and 89.21

joesternna — Sat, 04 Jul 2026 15:29:04 GMT

The users I support on the Microsoft Office 365 Current Release channel had a bad reaction to Office build 2606 and later. I had to roll back to 2605 to stop the constant crashing. Analyzing the memory dumps showed consistent issues with C:\Program Files (x86)\CheckPoint\Endpoint Security\EFR\cphnt64.dll. All office apps (PowerPoint, Excel, Word and Classic Outlook) were affected.

I have a TAC case open but have not received any feedback since I submitted DMP files a few days ago.

Microsoft's monthly channel is going to release 2606 very soon, so if you are running Endpoint you'll want to be ready.

Re: Office 365 June build (2606) crashes with Check Point Endpoint 89.10 and 89.21

aHAKANa — Mon, 06 Jul 2026 08:34:21 GMT

We also have two customers experiencing the same problem. However, our other customers don't seem to be affected. We are trying to identify which program or hardware is causing the problem.

Could you please let us know here if you find a solution?

Re: Office 365 June build (2606) crashes with Check Point Endpoint 89.10 and 89.21

PB_PT — Mon, 06 Jul 2026 14:24:39 GMT

Yes, same problem here.

We had an TAC contact and they are trying to help.

Re: Office 365 June build (2606) crashes with Check Point Endpoint 89.10 and 89.21

aHAKANa — Mon, 06 Jul 2026 14:29:54 GMT

Is this checkpoint's problem or not?

Outlooks keep crashing - Microsoft Q&A

Office 365 apps crashing periodically sin Monday the 29th June - Microsoft Q&A

Re: Office 365 June build (2606) crashes with Check Point Endpoint 89.10 and 89.21

joesternna — Mon, 06 Jul 2026 15:11:14 GMT

I asked Claude to help me write up my findings in my environment about why I think it's a Check Point issue, which I have pasted below. You can reproduce my steps in your environment.

1) Capture a memory dump of a hanging application on an affected user's computer- In Task Manager, right click the stuck application, click go to details, right-click the stuck process and choose Create Memory Dump file. It will probably be 1.5 GB or so but will zip to 25% of that size. Transfer it to your admin machine.

2) Load it into Debug Diagnostic Tool and run Crash Analysis. Compare it to what I've found. Do you see cphnt64.dll?

Environment

Check Point Endpoint Security — issue reproduced on client 89.10, persisted after updating to 89.21
Affected: Word, Excel, PowerPoint, Outlook — all four apps, across both physical laptops and hybrid-joined VMs
Onset: correlates with Microsoft Office Current Channel build 16.0.20131.20090 (released ~6/25) — also confirmed on the subsequent 20131.20112 release, so both 2606 builds to date are affected
OS: Windows 10, build 26200

Symptom:
Office applications become unresponsive intermittently — not a hard crash, a hang. No consistent user action triggers it; presents as a race condition (irregular timing, not reproducible on demand).

Root cause analysis:
Captured procdumps of hung processes for all four apps and ran them through DebugDiag 2's Crash/Hang Analysis. Three of the four (Outlook, PowerPoint, and an earlier Word capture) returned an identical automated finding:

Detected a serious critical section related problem
Lock at cphnt64!lvl+d808 is Uninitialized
Root cause function: cphnt64!CPH_InitHooks
Root cause module: C:\Program Files (x86)\CheckPoint\Endpoint Security\EFR\cphnt64.dll

Thread impact ranged from 15–25% of all threads blocked depending on the app. In each case, the blocked threads were waiting on a critical section inside cphnt64.dll that DebugDiag flagged as never having been properly initialized — classic deadlock-on-uninitialized-lock pattern.

A fourth dump (Excel) showed a related-but-distinct signature: an uninitialized lock inside ntdll!RtlpProcessHeaps rather than directly in cphnt64. Given that other thread stacks in our dumps show cphnt64's hook chain running through heap-related NT calls, we suspect this is a downstream heap corruption effect of the same underlying defect rather than an unrelated issue — but we don't have definitive proof of that link yet.

Why it hits all four Office apps identically:
cphnt64.dll is EFR (Endpoint Forensic Recorder) — it hooks low-level Windows API calls (NtClose, RegCloseKey, NtSetInformationFile, etc.) inside every monitored process for behavioral/ransomware detection. Since the hook is injected the same way into every Office process, a defect in its own internal locking manifests identically across Word, Excel, PowerPoint, and Outlook — they're not independently broken, they're all downstream of the same injected component.

What we ruled out:

Stale AV definitions — tested on machines with both current and outdated definitions; hangs occurred on both, ruling out a signature-file issue
Office add-ins — hang signature is consistent across machines with different add-in loadouts
One machine had not received recent Endpoint policy updates and still hung, initially suggesting Check Point wasn't involved — this turned out to be a red herring; that machine had stale AV definitions but was still running the same EFR component
Check Point client version — updated affected machines from 89.10 to 89.21; hangs continued with the identical CPH_InitHooks signature, ruling out a client-version-specific bug already fixed upstream

Mitigation attempted, and result:
We disabled Behavioral Protection → Anti-Ransomware Mode as an initial test. Hangs continued. New dumps taken after this change still show the identical CPH_InitHooks uninitialized-lock signature in Outlook and PowerPoint, meaning cphnt64.dll/EFR is still being loaded and initialized despite that blade being off. This strongly suggests EFR is shared infrastructure used by more than just the Anti-Ransomware feature (possibly Behavioral Guard more broadly, Anti-Exploit, or another blade) — we have not yet confirmed which other feature(s) are still invoking it.

Confirmed fix (workaround): Office rollback
Forcing an Office rollback to build 2505, deployed via the Office Deployment Tool (ODT) (not Cloud Update policy), eliminated the hangs entirely on machines where we tested it. Since the hangs persisted through a full Check Point client update (89.10 → 89.21) and only stopped after the Office rollback, this is strong evidence the trigger is specifically something introduced in the 2606 Office builds exposing a pre-existing EFR defect — not something already patched in 89.21. We have not modified any Check Point settings on the rollback-test machines; EFR/cphnt64.dll is fully active on them and they are stable at 2505.

Recommendation for others hitting this:
If you're on Office Current Channel build 16.0.20131.20090 or 20131.20112, and running Check Point Endpoint (89.10 or 89.21), and can tolerate holding back an Office update temporarily, an ODT-deployed rollback to build 2505 is a working stopgap while a permanent fix is developed. Updating the Check Point client alone did not resolve it in our environment. Note: Cloud Update policy rollback was not used/tested — we deployed the rollback via ODT specifically.

Open questions for Check Point / others hitting this:

Is there a known defect in CPH_InitHooks's critical section initialization tied to this EFR/client build? Confirmed still present in 89.21.
Which blades besides Anti-Ransomware Mode load cphnt64.dll? We need the full dependency list to know what else to try disabling as an alternative to a full Office rollback.
Has anyone reproduced this on Office builds other than the two 2606 releases (20131.20090, 20131.20112)?
Is there a newer EFR engine build (independent of client version 89.21) that addresses initialization races exposed by these Office builds?

TAC case open: 6-0004643260 — will update this thread as we get a response. Posting the technical detail here in case others are hitting the same thing and haven't gotten far enough to isolate the module.

Re: Office 365 June build (2606) crashes with Check Point Endpoint 89.10 and 89.21

joesternna — Mon, 06 Jul 2026 17:58:37 GMT

Environment:

Check Point Endpoint Security — issue reproduced on client 89.10, persisted after updating to 89.21
Affected: Word, Excel, PowerPoint, Outlook — all four apps, across both physical laptops and hybrid-joined VMs
Onset: correlates with Microsoft Office Current Channel build 16.0.20131.20090 (released ~6/25) — also confirmed on the subsequent 20131.20112 release, so both 2606 builds to date are affected

Symptom:

Office applications become unresponsive intermittently — not a hard crash, a hang. No consistent user action triggers it; presents as a race condition (irregular timing, not reproducible on demand).

Root cause analysis:

Captured procdumps of hung processes for all four apps and ran them through DebugDiag 2's Crash/Hang Analysis. Three of the four (Outlook, PowerPoint, and an earlier Word capture) returned an identical automated finding:

Detected a serious critical section related problem
Lock at cphnt64!lvl+d808 is Uninitialized
Root cause function: cphnt64!CPH_InitHooks
Root cause module: C:\Program Files (x86)\CheckPoint\Endpoint Security\EFR\cphnt64.dll

Why it hits all four Office apps identically:

cphnt64.dll is EFR (Endpoint Forensic Recorder) — it hooks low-level Windows API calls (NtClose, RegCloseKey, NtSetInformationFile, etc.) inside every monitored process for behavioral/ransomware detection. Since the hook is injected the same way into every Office process, a defect in its own internal locking manifests identically across Word, Excel, PowerPoint, and Outlook — they're not independently broken, they're all downstream of the same injected component.

What we ruled out:

Bad AV definitions — tested on machines with both current and outdated definitions; hangs occurred on both, ruling out a signature-file issue
Office add-ins — hang signature is consistent across machines with different add-in loadouts
One machine had not received recent Endpoint policy updates and still hung, initially suggesting Check Point wasn't involved — this turned out to be a red herring; that machine had stale AV definitions but was still running the same EFR component
Check Point client version — updated affected machines from 89.10 to 89.21; hangs continued with the identical CPH_InitHooks signature, ruling out a client-version-specific bug already fixed upstream

Mitigation attempted, and result:

We disabled Behavioral Protection → Anti-Ransomware Mode as an initial test. Hangs continued. New dumps taken after this change still show the identical CPH_InitHooks uninitialized-lock signature in Outlook and PowerPoint, meaning cphnt64.dll/EFR is still being loaded and initialized despite that blade being off. This strongly suggests EFR is shared infrastructure used by more than just the Anti-Ransomware feature (possibly Behavioral Guard more broadly, Anti-Exploit, or another blade) — we have not yet confirmed which other feature(s) are still invoking it.

Confirmed fix (workaround): Office rollback

Forcing an Office rollback to build 2505, deployed via the Office Deployment Tool (ODT) (not Cloud Update policy), eliminated the hangs entirely on machines where we tested it. Since the hangs persisted through a full Check Point client update (89.10 → 89.21) and only stopped after the Office rollback, this is strong evidence the trigger is specifically something introduced in the 2606 Office builds exposing a pre-existing EFR defect — not something already patched in 89.21. We have not modified any Check Point settings on the rollback-test machines; EFR/cphnt64.dll is fully active on them and they are stable at 2505.

Recommendation for others hitting this:

If you're on Office Current Channel build 16.0.20131.20090 or 20131.20112, and running Check Point Endpoint (89.10 or 89.21), and can tolerate holding back an Office update temporarily, an ODT-deployed rollback to build 2505 is a working stopgap while a permanent fix is developed. Updating the Check Point client alone did not resolve it in our environment. Note: Cloud Update policy rollback was not used/tested — we deployed the rollback via ODT specifically.

TAC case open: 6-0004643260

I will update this thread as we get a response. Posting the technical detail here in case others are hitting the same thing and haven't gotten far enough to isolate the module.

Re: Office 365 June build (2606) crashes with Check Point Endpoint 89.10 and 89.21

kale24 — Mon, 06 Jul 2026 19:33:54 GMT

Is this confirmed confined to E89? We are experiencing similar crashes on E88.72

Re: Office 365 June build (2606) crashes with Check Point Endpoint 89.10 and 89.21

joesternna — Mon, 06 Jul 2026 19:39:50 GMT

What I did:

On an affected machine, open Task Manager, right-click the hanging program (e.g. Excel.exe) and choose Create Memory Dump File. It creates a file about 1.5 GB on average, which zips down to about 25% of that size. Move that file to your admin machine and put it through Microsoft's Debug Diagnostic Tool

What version of Office is installed?

Re: Office 365 June build (2606) crashes with Check Point Endpoint 89.10 and 89.21

kale24 — Mon, 06 Jul 2026 19:43:40 GMT

Version 2606 in all cases.

I will forward your process to our helpdesk to see if we can grab those logs.

Thanks for the info.

Re: Office 365 June build (2606) crashes with Check Point Endpoint 89.10 and 89.21

SelimTech50 — Tue, 07 Jul 2026 05:08:28 GMT

Same Problem here..

Rolled back Tested 88.72.2001 Version same problem going on.

Our company not have WSUS . Windows update again updating latest version Office 365 We are stuck.

Checkpoint has to be fix this issue asap.

Re: Office 365 June build (2606) crashes with Check Point Endpoint 89.10 and 89.21

kale24 — Tue, 07 Jul 2026 12:40:43 GMT

Any update to your ticket?

Re: Office 365 June build (2606) crashes with Check Point Endpoint 89.10 and 89.21

DenisQ — Tue, 07 Jul 2026 13:53:31 GMT

We have identified the root cause of the Microsoft Office crash/freezing issue.
A new Office update has caused our injected code to dead lock which made Microsoft Office applications to sometimes freeze/crash.

A new update will be released which will prevent the dead lock from happening, and will be deployed to versions 89.10, 89.20, 89.21 automatically in the next 24 hours.

For customers who need an immediate solution, we have a fix that can be applied to version 89.21. This can be obtained by opening an SR with support.

Re: Office 365 June build (2606) crashes with Check Point Endpoint 89.10 and 89.21

kale24 — Tue, 07 Jul 2026 14:32:49 GMT

Thanks for the update.
I will start the E89.21 update testing and wait the auto fix.

Thanks

Re: Office 365 June build (2606) crashes with Check Point Endpoint 89.10 and 89.21

m25487 — Wed, 08 Jul 2026 06:14:40 GMT

Quick question: How can we tell if the automatic update has already been installed? Is deploying a new version not necessary?
Thanks

Re: Office 365 June build (2606) crashes with Check Point Endpoint 89.10 and 89.21

kale24 — Wed, 08 Jul 2026 14:32:02 GMT

Agreed, how can we tell if the fix is applied to E89.21? Not worth doing the extra work for the manual fix if the auto fix is applied already.

Re: Office 365 June build (2606) crashes with Check Point Endpoint 89.10 and 89.21

joesternna — Wed, 08 Jul 2026 17:34:40 GMT

Users whose Office install was returned to 2606 are still crashing on 08 July. I had requested the immediate solution be deployed to my tenant yesterday.

Because I can't tell if Endpoint was patched, I can't tell if the solution just hasn't been delivered yet or if it was delivered but it doesn't work.

Re: Office 365 June build (2606) crashes with Check Point Endpoint 89.10 and 89.21

joesternna — Wed, 08 Jul 2026 20:59:55 GMT

TAC just advised me that I can check this registry key for update status:

Computer\HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\CheckPoint\Endpoint Security\TPCommon\Updater\UpdateVersion

for 89.10 it should be 7202607082127 and for 89.2x it should be 7202607082202

I am looking at my own registry and don't see UpdateVersion, under Updater, but perhaps it will appear after the big reveal.

Re: Office 365 June build (2606) crashes with Check Point Endpoint 89.10 and 89.21

aHAKANa — Thu, 09 Jul 2026 06:54:21 GMT

Using 89.21 but problem not solved yet.

Re: Office 365 June build (2606) crashes with Check Point Endpoint 89.10 and 89.21

AlanCS — Thu, 09 Jul 2026 09:17:34 GMT

Any feedback? Still having the problems, using 89.10

Re: Office 365 June build (2606) crashes with Check Point Endpoint 89.10 and 89.21

BryantXPXU — Thu, 09 Jul 2026 09:50:30 GMT

Our environment also have this office crashes or freezes issue.
If our version is E88.50, when the checkpoint will update patches to this version? Or we must update to checkpoint 89.21.