Explainer

What is PresentationFontCache.exe and Why is it Running?

By John Bryntze

Updated March 1, 2024

If you’re browsing the running tasks on your Windows PC, you may notice a file called PresentationFontCache.exe and wonder why it’s running. We’ll explain what it does and how to make sure it’s malware-free.

If you’re looking at Task Manager on a Windows computer, you might see PresentationFontCache.exe running in the background. You might assume it has something to do with fonts. Is it a valid file? Could it be part of malware or a virus? Great questions. Let’s review what PresentationFontCache.exe is and why it is running. We’ll also discuss whether you should be concerned.

What is PresentationFontCache.exe?

PresentationFontCache.exe is a helper for your computer when you use certain apps. The file is part the .NET Framework. What it does is load information about your computer’s fonts (the way letters and characters look). This way, when you use specific types of apps (like those made with Windows Presentation Foundation), everything works smoothly.

In simple terms, PresentationFontCache.exe is there to make sure fonts look good in certain apps you might use. The fonts in the cache can become corrupted, though. This might cause such apps to use a lot of CPU power. Often, you can fix this by restarting the associated service mentioned further below.

Normally, you find this file in C:\Windows\Microsoft.NET\Framework64\v3.0\WPF . This folder can be different. It all depends on which version of Windows you are running.

It also has a related Windows Service running. Depending on the version of the PresentationFontCache.exe file, the service could have another name. However, it will be similar to  Windows Presentation Foundation Font Cache 3.0.0.0.

Is This File Safe?

The file is typically safe. After all, it is part of the Microsoft .NET Framework. Still, it’s crucial to be aware of potential security and performance concerns:

1. Malware Impersonation:  Malicious software can disguise itself using filenames that resemble legitimate system processes. This includes PresentationFontCache.exe. Always ensure that the process is located in the C:\Windows\Microsoft.NET\Framework64\v3.0\WPF directory. Later versions might change to 3.1 or 4.0 and so on. You should also make sure it’s digitally signed by Microsoft.
2. Resource Usage: In some instances, you might notice PresentationFontCache.exe consuming a significant amount of system resources like CPU. Such behavior might suggest that some fonts in the cache are corrupted and require deletion. As mentioned earlier, a restart of the service Windows Presentation Foundation Font Cache 3.0.0.0 usually fixes it. If that doesn’t fix the high CPU usage you might have to delete a font cache file under C:\Windows\ServiceProfiles\LocalService\AppData\Local named FontCache 3.0.0.0.dat and then reboot the computer.

How to Check if the File is Correctly Digitally Signed?

As mentioned, you may need to verify that PresentationFontCache.exe is located in the C:\Windows\Microsoft.NET\Framework64\v3.0\WPF directory first. Depending on which Windows version you run, you might be able to right-click the file in Explorer and look at the Digital Signature tab.

However, that option isn’t always visible in later versions of Windows 11. The following method, using PowerShell, works on all Windows versions. No worries, it is a one-liner that you can easily copy and paste to run.

1. 1. Open PowerShell (no need to open it elevated)
   2. Type in the following command and parameters:
      

      Get-AuthenticodeSignature -FilePath C:\Windows\Microsoft.NET\Framework64\v3.0\WPF\PresentationFontCache.exe | Format-List

      

1. Read the result. Since it is a Microsoft Windows system file, we want it to be signed by Microsoft and verify the following lines:

   • Issuer: CN=Microsoft Windows Production PCA 2011, O=Microsoft Corporation, L=Redmond, S=Washington, C=US

   • Status: Valid

2. If the issuer is the above, that indicates Microsoft issued the signing certificate. Next, the Status should read as valid. Those parameters together ensure that you can trust this file.

Don’t Worry, PresentationFontCache.exe Is Usually Perfectly Legit

As discussed, PresentationFontCache.exe is normally a valid Microsoft Windows file. To be safe, just verify the file has the correct digital signature. Also, be sure it runs from the correct folder matching the path to the related Windows Service.