| Previous | Next |
| STATUS_LPC_HANDLE_COUNT_EXCEEDED | STATUS_KERNEL_EXECUTABLE_MEMORY_WRITE |
STATUS_EXECUTABLE_MEMORY_WRITE
User-mode code wrote to an executable region
Writable executable memory is used by JIT compilers, hot patchers, instrumentation, and some compatibility layers, but it also creates a direct path for injected data to become code. This status indicates that a process participating in executable-write management detected such a write in its own user-mode context.
The event must be tied to the region lifecycle. A secure JIT commonly separates writable and executable phases or uses a brokered design, whereas unexpected writes into an image code section can indicate corruption, an unsupported hook, or exploitation.
What to inspect
- Record source instruction, target address, region allocation base, current protection, and mapped module or private-memory owner.
- Determine whether the process opted into dynamic-code restrictions or an executable-write tracking mechanism.
- Correlate the write with VirtualAlloc, VirtualProtect, section mapping, JIT compilation, or patch installation.
- Use W^X transitions or a documented brokered JIT path instead of leaving pages writable and executable together.
References
- Microsoft Open Specifications: NTSTATUS values
- Microsoft: Exploit protection reference
- Microsoft: PROCESS_MITIGATION_DYNAMIC_CODE_POLICY
- Microsoft: VirtualProtect
Looking for a different code? Search another status or error code.