Crash reported by Microsoft Office for Mac when Endpoint Protection is installed

Products

• Endpoint Protection

Issue/Introduction

Microsoft Office for Mac may report a crash when Endpoint Protection (SEP for Mac) is installed and SEP Vulnerability Protection is enabled (Intrusion Prevention).

The crash may occur when using any Office application — Word, Excel, PowerPoint, Outlook, et al.

The crashing module is typically libnetwork.dylib — a macOS component.

Example screenshots and error text below:

Microsoft Error Reporting log version: 2.0

Error Signature:
Exception: EXC_BAD_ACCESS
ExceptionEnumString: 1
Exception Code: KERN_INVALID_ADDRESS (0x642e796572666699)
Date/Time: 2022-03-24 16:59:10 +0000
Application Name: Microsoft PowerPoint
Application Bundle ID: com.microsoft.Powerpoint
Application Signature: PPT3
Application Bitness: x64
Application Version: 16.59.0.22031300
Crashed Module Name: libnetwork.dylib
Crashed Module Version: unknown version
Crashed Module Offset: 0x000000000036c8e4
Blame Module Name: unknown
Blame Module Version: 16.59.0.220313
UnsymbolicatedChecksum: 3D616F702B54B04C97CB82BF24F1A824
Blame Module Offset: unknown
StackHash: 38e78aea31d342d6_1_0x000000000036c8e4_bk_arm
Application LCID: 1033
Extra app info: Reg=en Loc=0x0409
Build Type: Release
Crashed thread Stack Pointer: 0x_00000002a0606470
Crashed thread: 38

Cause

Apple Webkit defect with Microsoft Office 365 TCP traffic.

Environment

macOS
SEP/SES for Mac

Resolution

Workaround is to disable SEP's network Vulnerability Protection (Intrusion Prevention).

The bulk of SEP's protection (AntiVirus / AntiSpyware and Firewall) can still be used.

Apple is currently working to resolve the issue under Apple Radar Ticket FB10017061.

This article will be updated as new information becomes available.