| Previous | Next |
| STATUS_THREADPOOL_RELEASED_DURING_OPERATION | STATUS_APC_RETURNED_WHILE_IMPERSONATING |
STATUS_CALLBACK_RETURNED_WHILE_IMPERSONATING
The callback leaked impersonation state onto a pooled worker
Thread-pool workers are reused for unrelated callbacks. If a callback impersonates a client and returns without reverting, the next callback can execute with the wrong security token. This is both a correctness failure and a security boundary violation; the leaked identity can grant or remove access unexpectedly.
Every successful impersonation transition needs structured cleanup on normal return, exceptions, cancellation, and early exits. Reverting in a different thread does not repair the original worker because impersonation state is thread-specific.
What to inspect
- Record the worker thread, original token, impersonation token, impersonation API, and all callback exit paths.
- Call
RevertToSelfor the matching RPC/COM revert routine in guaranteed cleanup code. - Fail closed if reverting impersonation fails; continuing pooled execution can contaminate later work.
- Avoid storing an impersonation token in process-global state without thread and lifetime ownership.
References
- Microsoft Open Specifications: NTSTATUS values
- Microsoft: RevertToSelf
- Microsoft: pooled threads and callback environments
- Microsoft: Thread Pool API
Looking for a different code? Search another status or error code.