Crash reported by Microsoft Office for Mac when Endpoint Protection is installed

Products

• Endpoint Protection

Issue/Introduction

Microsoft Office for Mac may report a crash when Endpoint Protection (SEP for Mac) is installed and SEP Vulnerability Protection is enabled (Intrusion Prevention).

The crash may occur when using any Office application — Word, Excel, PowerPoint, Outlook, et al.

The crashing module is typically libnetwork.dylib — a macOS component.

Example screenshots and error text below:

Microsoft Error Reporting log version: 2.0

Error Signature:
Exception: EXC_BAD_ACCESS
ExceptionEnumString: 1
Exception Code: KERN_INVALID_ADDRESS (0x642e796572666699)
Date/Time: 2022-03-24 16:59:10 +0000
Application Name: Microsoft PowerPoint
Application Bundle ID: com.microsoft.Powerpoint
Application Signature: PPT3
Application Bitness: x64
Application Version: 16.59.0.22031300
Crashed Module Name: libnetwork.dylib
Crashed Module Version: unknown version
Crashed Module Offset: 0x000000000036c8e4
Blame Module Name: unknown
Blame Module Version: 16.59.0.220313
UnsymbolicatedChecksum: 3D616F702B54B04C97CB82BF24F1A824
Blame Module Offset: unknown
StackHash: 38e78aea31d342d6_1_0x000000000036c8e4_bk_arm
Application LCID: 1033
Extra app info: Reg=en Loc=0x0409
Build Type: Release
Crashed thread Stack Pointer: 0x_00000002a0606470
Crashed thread: 38

Environment

macOS
SEP/SES for Mac

Cause

Apple Webkit defect with Microsoft Office 365 TCP traffic.

Resolution

Upgrade to 14.3 RU6 or newer.  For older versions of the Mac client, disabling Intrusion Prevention can be used as a workaround.