| Previous | Next |
| STATUS_MAPPED_ALIGNMENT | STATUS_LOST_WRITEBEHIND_DATA |
STATUS_IMAGE_CHECKSUM_MISMATCH
The PE header checksum no longer matches the file
PE images contain a CheckSum field calculated with format-specific rules. Windows validates it for selected system components, drivers, and loading paths. A mismatch can indicate corruption, an incomplete update, post-link modification, or a tool that changed the image without updating the header.
The PE checksum is not a cryptographic signature and should not be treated as proof of authenticity. A malicious or accidental modification can recalculate it. Signature verification, catalog validation, and trusted package hashes provide separate integrity evidence.
What to inspect
- Preserve the failing image and compare its header checksum with a value calculated by a PE-aware tool.
- Verify the package hash and Authenticode signature before deciding that only the checksum field is stale.
- Check updater, patcher, packer, and post-build steps that run after the linker writes the image.
- Investigate storage and transfer errors when multiple unrelated binaries acquire checksum failures.
References
- Microsoft Open Specifications: NTSTATUS values
- Microsoft: PE and COFF format
- Microsoft: verifying the signature of a PE file
- LLVM: llvm-readobj COFF inspection
Looking for a different code? Search another status or error code.