ASN1 out of memory 0x80093106 fix for Windows updates

You're installing a Windows update, maybe a cumulative patch for Windows 10 or 11, or deploying Microsoft 365 via Office Deployment Tool. Midway through, it stops. You open Event Viewer or get a pop-up showing ASN1 (0X80093106) - out of memory. This isn't a RAM issue. It's a corrupted ASN.1 (Abstract Syntax Notation One) certificate block inside the local update cache. Windows tries to verify the update's digital signature, hits a malformed certificate structure, and throws 'out of memory' as a generic catch-all. I've seen this most often after a failed update that left behind half-written .cab files in C:\Windows\SoftwareDistribution.

Why this happens

The real root cause: Windows Update stores downloaded package files inside the SoftwareDistribution folder. If a previous update got interrupted—power loss, forced reboot, network dropout—those files get written in an incomplete state. The ASN.1 parser inside crypt32.dll expects proper binary encoding of certificate chains. When it finds a truncated or bit-flipped block, it can't allocate memory for the parsed structure because the data doesn't match the expected schema. So it bails with 0x80093106.

Skipping fixes like 'run Windows Update troubleshooter' won't cut it here. That tool rarely fixes deep certificate corruption. You need to clear the cache manually, then let Windows re-download fresh copies.

Fix: Clear the update cache and rebuild

These steps work on Windows 10 22H2, Windows 11 23H2, and Server 2022. You'll need admin rights.

1. Stop the Windows Update service.
   Press Win + R, type services.msc, and hit Enter. Find Windows Update in the list. Right-click it, select Stop. Wait for the status to change to 'Stopped'—should take 2-3 seconds. If it doesn't stop, open Task Manager and end any svchost.exe instance running with the wuauserv description.
2. Stop the Background Intelligent Transfer Service (BITS).
   In the same Services window, find Background Intelligent Transfer Service. Right-click and stop it. This prevents any pending downloads from interfering while you clean up.
3. Delete the SoftwareDistribution folder.
   Open File Explorer and go to C:\Windows\SoftwareDistribution. Select all folders inside (DataStore, Download, etc.) and delete them. If you get a file-in-use error, you missed stopping a service. Reboot into Safe Mode with Networking and try again. On a clean stop, deletion takes under a minute.
4. Clear the temp certificate store.
   Open an admin Command Prompt (right-click Start > Command Prompt (Admin)). Run:
   

   del /f /s /q %windir%\system32\catroot2\*.*

   This deletes the cached certificate catalog files. Don't worry—Windows rebuilds them automatically on next update check.
5. Restart the services.
   Go back to Services.msc, right-click both Windows Update and BITS, and select Start. Wait for 'Running' status.
6. Re-trigger Windows Update.
   Go to Settings > Windows Update and click Check for updates. The first check might be slow as it rebuilds the SoftwareDistribution folder and downloads fresh metadata. Expect 2-5 minutes depending on your internet speed.

After this, the 0x80093106 error should be gone. The update that previously failed will now download and install cleanly.

If it still fails

Sometimes the corruption goes deeper than the update cache. You've got two backup fixes to try, in order:

Run DISM and SFC

Open admin Command Prompt and run:

DISM /Online /Cleanup-Image /RestoreHealth

sfc /scannow

Manually re-register crypt32.dll

If DISM found no issues but the error persists, the COM registration for the crypto service might be hosed. In admin Command Prompt, type:

regsvr32 /u crypt32.dll
regsvr32 crypt32.dll

I've seen a handful of cases where the culprit was a third-party security tool intercepting certificate verification. If you're running Bitdefender, Malwarebytes, or Kaspersky, temporarily disable real-time protection or uninstall the tool before running Windows Update. Reinstall it after the update completes.

That's it. The 0x80093106 error is almost always fixable with cache clearing. You don't need to reformat, run system restore, or call Microsoft support. Just delete the folder, restart the service, and let Windows start fresh.