| Previous | Next |
| ERROR_NOT_SAME_OBJECT | ERROR_SET_CONTEXT_DENIED |
ERROR_STRICT_CFG_VIOLATION
The process refused to load a non-CFG image under strict CFG policy.
ERROR_STRICT_CFG_VIOLATION is Win32 error 1657 (0x679). Under strict Control Flow Guard policy, every executable image loaded into the process must satisfy the policy’s CFG requirement. A legacy DLL may be correctly signed and otherwise loadable yet still be rejected because its PE image lacks the guard metadata and instrumentation expected by the process.
Common sources of the incompatible image
- an old third-party plug-in or codec was compiled without Control Flow Guard
- a vendor shipped mixed binaries and one architecture or optional module lacks guard metadata
- a custom build enabled CFG for the host executable but not for every loaded DLL
- an updater restored an older non-CFG dependency into the application directory
- a search-path collision loads an unintended DLL before the compatible copy
Loader facts to preserve
Capture the full path and hash of the blocked image, signer, product version, architecture, host process path, effective CFG mitigation flags, loader search path, parent process, and the operation that initiated loading. Record whether the image has CFG load-configuration data and whether a different copy was expected. Do not diagnose by filename alone because side-by-side versions often coexist.
How to verify the cause
Inspect the actual image selected by the loader and its PE load configuration. Confirm that the host runs with strict CFG rather than ordinary CFG. Compare compiler and linker settings across all modules, including delay-loaded and optional plug-ins. A dependency walker or loader trace can reveal that the rejected file is not the package version operators expected.
Check application-control and exploit-protection deployment history, but do not assume policy is wrong merely because the application previously worked. The policy may have exposed an unsupported binary. Test a vendor-provided CFG-enabled build in an isolated environment and validate all secondary dependencies.
Resolution and prevention
Replace or rebuild the image with CFG enabled and link it with appropriate guard metadata. Remove unintended stale copies and correct deterministic DLL search paths. Relax strict policy only when there is no compatible binary and a documented security exception has been approved for this exact application.
Build systems should compile and link every native module with CFG, verify PE guard flags in release artifacts, and test plug-in discovery under the intended mitigation policy. Updaters should prevent downgrade to noncompliant DLLs.
Difference from a bad image or blocked dynamic code
ERROR_BAD_EXE_FORMAT covers malformed or wrong-architecture images. Error 1657 is specifically a strict CFG compatibility decision. ERROR_DYNAMIC_CODE_BLOCKED concerns code generated or modified at runtime rather than loading a PE image without required CFG support.
Example
A hardened browser host loads a legacy document plug-in and receives 1657. The DLL is signed and x64, but inspection shows no CFG metadata. Installing the vendor’s newer CFG-enabled plug-in resolves the load while keeping strict policy enabled.
References
- Microsoft: System Error Codes (1300–1699)
- Microsoft: PROCESS_MITIGATION_CONTROL_FLOW_GUARD_POLICY
- Microsoft: /guard:cf
Looking for a different code? Search another status or error code.