WUDFHost.exe

Windows ProcessMicrosoft Corporation

Also called wudfhost, umdf host, user-mode driver host

WindowsSystem Component

User-Mode Driver Framework host. It loads UMDF driver DLLs such as WinUSB in user mode. It is not a kernel .sys image and it is not WmiPrvSE.

What you need to know

WUDFHost is UMDF user-mode driver host, not WmiPrvSE.

WUDFHost.exe is the process the UMDF driver manager starts so a user-mode driver can run outside the kernel. WinUSB gadgets, some portable devices, and similar stacks live here. WmiPrvSE.exe answers CIM queries. A crash here should not blue-screen the way a bad kernel driver can.

Safe?: Yes, with a UMDF device
Is it a kernel driver?: No. It is the user-mode host
Same as WmiPrvSE?: No

Feex says

If I see WUDFHost climb after I plugged in a USB gadget, I look at that device's UMDF driver. I do not open WMI as my first guess.

What is WUDFHost.exe?

WUDFHost.exe is the UMDF user-mode driver host. The driver manager starts it so WinUSB and other UMDF drivers run in user mode. It is not WmiPrvSE.exe. Swapping those names is wrong.

What does it do?

It loads vendor UMDF DLLs and talks to the kernel reflector. It does not host CIM providers. The image can also appear under DriverStore when a package ships its own host copy.

Why is it running?

A UMDF device is present: a phone in file mode, a microcontroller on WinUSB, a portable gadget, or another user-mode stack. No such device often means this host should be idle or gone.

Why are there multiple copies?

More than one WUDFHost.exe can be different UMDF stacks. Pooling can also put several devices in one host. That is still user-mode drivers, not WmiPrvSE.

Is it safe?

Usually safe

A Microsoft-signed WUDFHost in System32 or a DriverStore package is the UMDF host. A WUDFHost.exe on the desktop is not that host. It is still not a WMI provider process.

A legitimate copy normally runs from:

C:\Windows\System32\WUDFHost.exe

Expected publisher: Microsoft Corporation
Also seen under FileRepository / DriverStore for a package
Not WmiPrvSE.exe and not a .sys kernel image

Can I end it?

That UMDF device drops

Ending WUDFHost.exe unloads the user-mode drivers in that host. The gadget can vanish from apps until Plug and Play starts another host. It does not stop WmiPrvSE.

Can I remove it?

Do not delete WUDFHost.exe. Uninstall the UMDF device from Device Manager if you want that stack gone. Leave the System32 host in place.

Should it start with Windows?

The UMDF driver manager starts hosts when a device needs them. This is not Startup Apps.

Normal resource behavior

These are contextual labels, not universal averages.

CPU: Follows I/O on the UMDF device
Memory: Grows if a user-mode driver leaks
Disk: Low unless the gadget is a storage bridge
Network: Only if that UMDF driver talks on the network

File information

WUDFHost.exe file information
Executable name	WUDFHost.exe
Common legitimate path	C:\Windows\System32\WUDFHost.exe
Publisher	Microsoft Corporation
Signature expectation	Signed by Microsoft Windows

Common problems

USB gadget gone after an "optimizer" killed the host

Plug the device out and in. If it never returns, the UMDF driver needs repair. WMI reset will not help.

People hunt WmiPrvSE because the name looks "system"

Open the host modules. A WinUSB or portable-device DLL is the tell. CIM providers live in WmiPrvSE.

Troubleshooting

Diagnose before you change anything destructive.

List the DLLs inside this host

Process Explorer modules. The UMDF driver name is the fix target. That list will not look like a WMI provider host.

Device Manager: uninstall the UMDF device, then rescan

Update that user-mode driver from the vendor. Do not replace WUDFHost.exe from a forum zip.

Technical details

WUDFHost.exe technical details
Image name	WUDFHost.exe
Role	UMDF user-mode driver host

Sources and verification

Reviewed by Feex editorial. Last verified August 2026 Status: Feex Reviewed. How we research.

Microsoft Learn: UMDF overview · User-mode drivers run in a host process
Microsoft Learn: UMDF host process · Wudfhost.exe loads UMDF driver DLLs
Foxhole process map · First-party samples on Windows PCs. Not a lab benchmark.

Was this article useful?

A yes or no is enough. Pick a reason if you want, or add a short note.