What does NTSTATUS 0xC00001A5 (STATUS_INVALID_EXCEPTION_HANDLER) mean?

STATUS_INVALID_EXCEPTION_HANDLER

Exception dispatch rejected the handler target

STATUS_INVALID_EXCEPTION_HANDLER means Windows detected an invalid exception-handler routine while processing an exception. The important evidence is the exception-dispatch state and handler address; a general tutorial about structured exception handling does not identify why this specific validation failed.

What to inspect

• Capture the original exception, thread context, stack, module list, and handler address before secondary exception handling changes the stack.
• Check for stack corruption, overwritten registration or unwind metadata, use of an unloaded module, or hand-written assembly/unwind data that does not match the platform ABI.
• If control-flow protections report additional details, preserve them instead of treating this status as proof of one exploit technique.

Recovery boundary

Correct the corruption or invalid unwind/handler metadata that produced the rejected target. Catching this status higher in the process is not a reliable repair for damaged exception-dispatch state.

References

• Microsoft Open Specifications: NTSTATUS values
• Microsoft: Using NTSTATUS values