| Previous | Next |
| STATUS_INVALID_IMAGE_LE_FORMAT | STATUS_INVALID_IMAGE_PROTECT |
STATUS_INVALID_IMAGE_NOT_MZ
The file does not begin with a valid PE-compatible MZ header
A Windows PE image begins with an IMAGE_DOS_HEADER whose magic value is MZ. The loader uses fields in that header, especially e_lfanew, to locate the PE signature and NT headers. This status therefore indicates a basic format mismatch, truncation, or corruption before import processing or signature validation can begin.
The file might be an archive, script, ELF binary, raw firmware blob, response page downloaded instead of a binary, or a partially written executable. Relying on the filename extension can hide those cases.
What to inspect
- Inspect the first bytes and file size, then verify that e_lfanew points inside the file to a valid PE signature.
- Check transport and extraction logs for truncation, text-mode conversion, proxy error pages, or incomplete updates.
- Compare the file against a trusted package hash before replacing or attempting repair.
- Treat untrusted malformed headers as parser input and validate all offsets before dereferencing them.
References
- Microsoft Open Specifications: NTSTATUS values
- Microsoft: PE and COFF format
- LLVM source: COFF object parsing
- Wine source: PE module loader
Looking for a different code? Search another status or error code.