| Previous | Next |
| STATUS_REGISTRY_HIVE_RECOVERED | STATUS_DLL_MIGHT_BE_INCOMPATIBLE |
STATUS_DLL_MIGHT_BE_INSECURE
The selected module can weaken DLL loading security
This warning concerns how executable code is selected, not simply whether the DLL exists. A bare module name, legacy search behavior, or a location writable by an untrusted user can allow a different binary to be chosen before the intended system or application copy. Windows can report that a more secure module choice is available.
The safe correction is to make module resolution deterministic. Applications should use trusted installation directories, explicit search flags, and full paths where appropriate. Suppressing the warning while retaining a user-writable search location leaves the code-loading vulnerability intact.
What to inspect
- Record the resolved full path, requested module name, loader flags, current directory, and process DLL search configuration.
- Check every directory searched before the intended module for locations writable by lower-privileged users.
- Prefer LoadLibraryEx with LOAD_LIBRARY_SEARCH flags and SetDefaultDllDirectories for controlled dependency resolution.
- Verify signatures after resolving the path; signature checks do not make an unsafe search order deterministic.
References
- Microsoft Open Specifications: NTSTATUS values
- Microsoft: dynamic-link library search order
- Microsoft: LoadLibraryEx
- Wine source: PE module loader
Looking for a different code? Search another status or error code.