Bitwig Studio Plugin Host
Bitwig-plugin-host-exe is the Bitwig Studio component responsible for loading and managing all third-party plugins (VST2/VST3) within a project. It creates, updates, and reconciles plugin instances, handles their audio processing, and communicates with the main Bitwig Studio UI to deliver real-time parameter changes and automation. This host is essential for stable plugin operation, per-project plugin graphs, and consistent performance across track layouts, buses, and devices.
BitwigPluginHost.exe runs as a separate process that hosts VST plugins, executes their DSP graphs, and routes audio/MIDI to the Bitwig Studio engine. It uses IPC with the main UI, supports per-plugin instances, and enforces lifecycle events during startup, plugin scan, and project changes.
Bitwig-plugin-host-exe is a legitimate Bitwig Studio component designed to host VST plugins and manage their lifecycle. When you install Bitwig Studio from the official site, the executable resides in the Bitwig installation directory and is digitally signed by Bitwig GmbH. If you encounter this process running outside the Bitwig folder, or with an unsigned signature, treat it as suspicious. In normal operation, the host communicates with the main Bitwig process, runs with trusted privileges, and does not autonomously access network resources or modify essential system files.
While malware authors may mimic legitimate processes, bitwig-plugin-host-exe is not inherently malicious when obtained from the official Bitwig Studio installer. It typically runs within the Bitwig Program Files directory and carries Bitwig GmbH's signature. If you see the executable in an unexpected location, with an unfamiliar signature, or if it requests unusual permissions, investigate by verifying the path, signature, and hash. Always keep Bitwig updated to reduce risk from tampered installers.
Red Flags: Unsigned signatures, a path outside the installation folder, unexpected network activity, or repeated anomalous launches without Bitwig Studio opened are red flags for a compromised plugin host.
Reasons it's running: