Codex crash on Windows10 Home 22H2

What version of the Codex App are you using (From “About Codex” dialog)?

版本 26.623.81905 • 发布于 2026年7月1日

What subscription do you have?

login by api-key mode

What platform is your computer?

Microsoft Windows NT 10.0.19045.0 x64

What issue are you seeing?

CPU ：AMD R7-5800H

1. Problem Symptom

After double-clicking Codex.exe to launch, the program pops up briefly and crashes within ~2.3 seconds without any error prompt. I captured the full process trace via Microsoft Process Monitor for troubleshooting.

1. Initial Process Monitor Log Analysis

Captured complete event logs of PID 17088 (main Codex process) starting at 12:48:00.
Observed multiple third-party DLL injections: Sangfor VPN network hook modules (SangforTcpX64.dll, SangforNspX64.dll) and several Sogou Input bundles.
Found the main process exited with NTSTATUS code -1073741819 (translates to 0xC0000005 Access Violation), while all Chromium child processes exited normally with code 0.
The log recorded Codex automatically generating crash dumps under path:
C:\Users\User\AppData\Roaming\Codex\web\Codex\Crashpad\reports

1. Crash Dump Analysis with WinDbg

Downloaded official WinDbg from Microsoft Store and configured public Microsoft symbol server.
Loaded the generated .dmp crash dump file and ran the core diagnostic command !analyze -v.
Key crash analysis results:
Exception Code: 0xc0000005 Access Violation
Violation Type: INVALID_POINTER_READ — the program attempted to read memory from NULL address 0x0000000000000000
Faulting binary module: windows-updater.node (offset 0x16dd3)
Fault assembly instruction: mov rax,qword ptr [rcx], where register rcx = NULL
Crash bucket tag: INVALID_POINTER_READ_c0000005_windows-updater.node!Unknown
Critical conclusion from dump: The crash is NOT caused by Sangfor VPN or Sogou Input DLL injection. The access violation occurs inside Codex’s built-in Windows Update detection native Node module, with no third-party libraries present in the crash stack trace. Warnings about DLL checksums in WinDbg are irrelevant and do not affect root cause identification.

1. Root Cause

Codex’s embedded windows-updater.node native module lacks null pointer validation logic when querying Windows Update service/system update metadata. When the module retrieves an empty system structure pointer and tries to dereference it, a null pointer read exception is thrown, terminating the entire application.
Possible triggers for the null pointer:
Corrupted Windows Update system components/services
Damaged Codex local module files (windows-updater.node)
Insufficient permissions to access Windows Update registry entries
Permanent Fix Options
Repair Windows system files & Windows Update service via CMD (admin):

sfc /scannow DISM /Online /Cleanup-Image /RestoreHealth

Then I can Open it

What steps can reproduce the bug?

I have reinstalled it several times before, but the same crash issue would occur after a few days of use. Changing the version in the meantime didn't solve the problem either
I restart computer, and I see it again.

What is the expected behavior?

_No response_

Additional information

Attachment 1 is the exported log from the Windows Process Monitor, recording the process of Codex opening and crashing

Logfile.CSV

Below are the results of the dump analysis conducted through Windbg：

*********** Preparing the environment for Debugger Extensions Gallery repositories ************
ExtensionRepository : Implicit
UseExperimentalFeatureForNugetShare : true
AllowNugetExeUpdate : true
NonInteractiveNuget : true
AllowNugetMSCredentialProviderInstall : true
AllowParallelInitializationOfLocalRepositories : true
EnableRedirectToChakraJsProvider : false

-- Configuring repositories
----> Repository : LocalInstalled, Enabled: true
----> Repository : UserExtensions, Enabled: true

>>>>>>>>>>>> Preparing the environment for Debugger Extensions Gallery repositories completed, duration 0.047 seconds

*********** Waiting for Debugger Extensions Gallery to Initialize ************

>>>>>>>>>>>> Waiting for Debugger Extensions Gallery to Initialize completed, duration 0.234 seconds

----> Repository : UserExtensions, Enabled: true, Packages count: 0
----> Repository : LocalInstalled, Enabled: true, Packages count: 29

Microsoft (R) Windows Debugger Version 10.0.28000.2270 X86
Copyright (c) Microsoft Corporation. All rights reserved.

Loading Dump File [C:\Users\XiaoHuYa\Desktop\0f205885-c438-4a00-9821-d3606a7c72a5.dmp]
User Mini Dump File: Only registers, stack and portions of memory are available

*********** Path validation summary ************
Response Time (ms) Location
Deferred srvC:\symbolshttps://msdl.microsoft.com/download/symbols
Symbol search path is: srvC:\symbolshttps://msdl.microsoft.com/download/symbols
Executable search path is:
Windows 10 Version 19045 (6466) MP (16 procs) Free x64
Product: WinNt
Edition build lab: Windows NT 10.0.19045.6466
Debug session time: Thu Jul 2 12:48:02.000 2026 (UTC + 8:00)
System Uptime: 0 days 3:19:34.854
Process Uptime: 0 days 0:00:02.000
................................................................
................................................................
.....
Loading unloaded module list
.........
This dump file has an exception of interest stored in it.
The stored exception information can be accessed via .ecxr
(42c0.5e5c): Access violation - code c0000005 (first/second chance not available)
For analysis of this file, run !analyze -v
* WARNING: Unable to verify checksum for ntdll.dll
* WARNING: Unable to verify checksum for KERNELBASE.dll
ntdll!NtDelayExecution+0x14:
00007ff8`7aa4dc24 c3 ret
0:014> !analyze -v
..* WARNING: Unable to verify checksum for ntdll.dll
..............................................................
................................................................
.....
Loading unloaded module list
.........
* WARNING: Unable to verify checksum for KERNELBASE.dll
*******************************************************************************

• *
• Exception Analysis *
• *

*******************************************************************************

* WARNING: Unable to verify checksum for ole32.dll
* WARNING: Unable to verify checksum for twinapi.appcore.dll

KEY_VALUES_STRING: 1

Key : AV.Dereference
Value: NullPtr

Key : AV.Type
Value: Read

Key : Analysis.CPU.mSec
Value: 500

Key : Analysis.Elapsed.mSec
Value: 16530

Key : Analysis.IO.Other.Mb
Value: 13

Key : Analysis.IO.Read.Mb
Value: 27

Key : Analysis.IO.Write.Mb
Value: 45

Key : Analysis.Init.CPU.mSec
Value: 4828

Key : Analysis.Init.Elapsed.mSec
Value: 130827

Key : Analysis.Memory.CommitPeak.Mb
Value: 123

Key : Analysis.Version.DbgEng
Value: 10.0.28000.2270

Key : Analysis.Version.Description
Value: 10.2506.23.01 x86fre

Key : Analysis.Version.Ext
Value: 1.2506.23.1

Key : Failure.Bucket
Value: INVALID_POINTER_READ_c0000005_windows-updater.node!Unknown

Key : Failure.Exception.Code
Value: 0xc0000005

Key : Failure.Exception.IP.Address
Value: 0x7ff818316dd3

Key : Failure.Exception.IP.Module
Value: windows_updater

Key : Failure.Exception.IP.Offset
Value: 0x16dd3

Key : Failure.Hash
Value: {7b9794d0-f3f3-7479-ed02-c55445dc3401}

Key : Failure.ProblemClass.Primary
Value: INVALID_POINTER_READ

Key : Timeline.OS.Boot.DeltaSec
Value: 11974

Key : Timeline.Process.Start.DeltaSec
Value: 2

Key : WER.Process.Version
Value: 149.0.7827.115

FILE_IN_CAB: 0f205885-c438-4a00-9821-d3606a7c72a5.dmp

NTGLOBALFLAG: 0

CONTEXT: (.ecxr)
rax=00007ff8183f6920 rbx=0000019d6e7cf940 rcx=0000000000000000
rdx=0000000000000004 rsi=0000001f8a9ffc08 rdi=0000001f8a9ffc20
rip=00007ff818316dd3 rsp=0000001f8a9ffb60 rbp=0000001f8a9ffba8
r8=0000001f8a9ffa40 r9=0000019d6e7cf940 r10=000000007fffffff
r11=0080000000000000 r12=00007ff87a9dfaa0 r13=00000000000000d0
r14=0000000000000000 r15=00007ff8183f6c90
iopl=0 nv up ei pl zr na po nc
cs=0033 ss=0000 ds=0000 es=0000 fs=0053 gs=002b efl=00010246
windows_updater+0x16dd3:
00007ff818316dd3 488b01 mov rax,qword ptr [rcx] ds:0000000000000000=????????????????
Resetting default scope

EXCEPTION_RECORD: (.exr -1)
ExceptionAddress: 00007ff818316dd3 (windows_updater+0x0000000000016dd3)
ExceptionCode: c0000005 (Access violation)
ExceptionFlags: 00000000
NumberParameters: 2
Parameter[0]: 0000000000000000
Parameter[1]: 0000000000000000
Attempt to read from address 0000000000000000

PROCESS_NAME: Codex.exe

READ_ADDRESS: 0000000000000000

ERROR_CODE: (NTSTATUS) 0xc0000005 - 0x%p 0x%p %s

EXCEPTION_CODE_STR: c0000005

EXCEPTION_PARAMETER1: 0000000000000000

EXCEPTION_PARAMETER2: 0000000000000000

IP_ON_STACK:
+0
0000001f`8a9ffbf0 0000 add byte ptr [rax],al

FRAME_ONE_INVALID: 1

STACK_TEXT:
0000001f8a9ffb60 0000001f8a9ffbf0 : 0000019d7244e760 0000000000000000 0000019d6e7cf940 0000125c00a6c460 : windows_updater+0x16dd3
0000001f8a9ffb68 0000019d7244e760 : 0000000000000000 0000019d6e7cf940 0000125c00a6c460 00007ff800000203 : 0x0000001f8a9ffbf0
0000001f8a9ffb70 0000000000000000 : 0000019d6e7cf940 0000125c00a6c460 00007ff800000203 00007ff8183f6920 : 0x0000019d7244e760

SYMBOL_NAME: windows_updater+16dd3

MODULE_NAME: windows_updater

IMAGE_NAME: windows-updater.node

STACK_COMMAND: ~14s; .ecxr ; kb

FAILURE_BUCKET_ID: INVALID_POINTER_READ_c0000005_windows-updater.node!Unknown

OSPLATFORM_TYPE: x64

OSNAME: Windows 10

FAILURE_ID_HASH: {7b9794d0-f3f3-7479-ed02-c55445dc3401}

Followup: MachineOwner
---------