Late in 2018, Windows 10 users began finding a process called cmimageworker.exe using a large share of their CPU. Many assumed it was malware. It turned out to be tied to a Windows feature, and Microsoft was reported to be testing a fix for the high CPU use on Windows 10 version 1809. Here is what the process is and what you can do about it.
What cmimageworker.exe is
The question first reached Microsoft’s community forum on November 19, 2018. A user found cmimageworker.exe in C:\Windows\System32, said it was using around 70% of the system’s resources and was hard to delete, and could find information about it only in Japanese. More than 80 people later marked that they had the same question.
The most helpful answer in that thread, posted on February 14, 2019, linked the process to Windows Defender Application Guard (WDAG), the feature that opens untrusted websites in an isolated container. On Windows 10 1809, the file appears in System32 when WDAG is turned on. When WDAG is off, it only sits in the WinSxS component store, next to CmService.dll and cmclient.dll. The poster noted that Microsoft had not confirmed this explanation officially.
The same high CPU use showed up on an Insider build too, where Microsoft called cmimageworker a bug, not a virus.
Is cmimageworker.exe a virus?
Not when it sits in System32 or WinSxS alongside the WDAG files. Some early forum replies called it a cryptocurrency-mining trojan, but they gave no evidence. Still, any file name can be imitated, so check where the file lives. A copy in an unusual folder deserves a full malware scan with Windows Security.
The forum answer also warned against using random “virus removal” tools to delete the file. Removing parts of a Windows feature can do more harm than the CPU spike.
How to stop cmimageworker high CPU usage
Until a fix reached your PC, the workaround reported on Microsoft’s forum was to turn off Windows Defender Application Guard if you don’t use it:
- Open Start and type Turn Windows features on or off.
- Open the result.
- Uncheck Windows Defender Application Guard.
- Select OK and restart the PC when asked.
- Check C:\Windows\System32 again. cmimageworker.exe should no longer be there.
On work PCs, an administrator’s policy may keep WDAG switched on. In that case ask your IT team rather than forcing the change.
Check CPU use after the fix
Open Task Manager with Ctrl+Shift+Esc and sort the Processes tab by CPU. If cmimageworker.exe is gone or idle, the change worked. If another process is now at the top, Task Manager can help you fix a slow computer step by step.
Today
Windows 10 version 1809 is long out of support. If you still see heavy CPU use from cmimageworker.exe, install the latest Windows updates first, then use the steps above to test whether Application Guard is the trigger.
