Key Takeaways

  • A database write-ahead log file (CapabilityAccessManager.db-wal) is silently growing to hundreds of gigabytes on affected Windows 11 systems.
  • The issue stems from an OS logging loop failing to compact SQLite transactions properly.
  • Windows 11 update KB5095093 (released June 29, 2026) resolves the leak.
  • Administrators can safely verify file sizes using a non-destructive Robocopy command.

If your system drive is suddenly running out of space and you cannot find the culprit, a newly confirmed Windows 11 bug might be responsible. Reports from users and system administrators reveal that a protected system database file is silently ballooning in size, consuming up to 500GB of storage.

Microsoft has quietly acknowledged the problem and rolled out a patch. Below, we break down what is causing the issue, how to check if your fleet is affected, and the steps required to resolve it.

What is the Capability Access Manager Bug?

A database logging error in Windows 11 is causing the Capability Access Manager database log (CapabilityAccessManager.db-wal) to grow out of control. Under normal operating conditions, this file resides at less than 4MB. However, bug reports on Reddit and the Microsoft Feedback Hub document affected systems where this single file exceeds 500GB.

The Capability Access Manager (CAM) is a core OS service that tracks and manages applications requesting access to hardware privacy features. These include the microphone, camera, location services, and screen capture tools.

To maintain transparency, CAM records access events in a local SQLite database. The .db-wal extension indicates a write-ahead log—a temporary file used to store database transactions before they are committed and merged into the main database.

Due to a design oversight introduced in early 2026, the OS fails to trigger the checkpoint merge process correctly. As applications repeatedly check for hardware permissions, transactions pile up indefinitely, causing the log file to expand until the hard drive is entirely full.

How to Check if Your PC is Affected

System administrators cannot easily inspect the CAM directory because the folder is protected by Windows NT permissions. Standard attempts to open the directory in File Explorer or query it via PowerShell will yield an "Access Denied" error.

Rather than changing folder ownership—which can compromise system security templates—you can query the file size using a read-only command. Open an elevated Command Prompt and run the following Robocopy command:

robocopy "C:\ProgramData\Microsoft\Windows\CapabilityAccessManager" "%TEMP%\CAMCheck" /L /B /R:0 /W:0 /BYTES /NP

This command leverages Robocopy's backup mode (/B) to read the protected folder structure without changing file permissions. The listing mode (/L) ensures no files are actually copied. Locate the CapabilityAccessManager.db-wal line in the output. If the file size is under 5MB, your system is unaffected. If it displays several gigabytes, the leak is active.

Implementing the Official Microsoft Fix

Microsoft released the official fix for the CAM storage leak in optional update KB5095093 on June 29, 2026. The patch improves disk space management by forcing the SQLite engine to compact write-ahead log files properly.

For organizations managing active system fleets, the recommended resolution pathway depends on drive status:

  1. Active Windows Update: If your system drive still has sufficient space, navigate to Settings > Windows Update and install optional cumulative update KB5095093. The fix will also deploy automatically as part of the July 14, 2026 Patch Tuesday rollout.
  2. WinRE Workaround: If the C: drive is completely full, Windows Update will fail to download or stage the patch. In this scenario, administrators must boot into the Windows Recovery Environment (WinRE) or Safe Mode, navigate to the CAM directory, and rename the .db-wal file. Upon normal boot, Windows will generate a fresh, small log file, freeing up the storage required to install the update.

Conclusion

Silently expanding database logs can quickly disrupt business operations, especially in virtual desktop environments (VDI/DaaS) where disk space allocations are tightly monitored.

If your organization is dealing with unexplained storage consumption or needs assistance deploying system updates across your business network, contact us today. Our systems engineering team can run diagnostics, automate the cleanup, and verify that your fleet is fully patched against ongoing Windows 11 bugs.