owasp-modsecurity / owasp-modsecurity/ModSecurity

2,9,7 Appl Error 1000 in w3wp.exe Module ucrtbase.dll

Open
#3,397 14 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

2.x
Dominant language
C++
Stars
9.8k
Forks
1.8k
Avg merge
2h 46m
Merged PRs (30d)
1

Description

I uploade an image on WordPress 6.8.1 / PHP 8.4. 7 / Win Srv 2025 and IIS crashes. I tried it several times, always the same result

AppName w3wp.exe
AppVersion 10.0.26100.1882
AppTimeStamp c6bd45bd
ModuleName ucrtbase.dll
ModuleVersion 10.0.26100.4061
ModuleTimeStamp 8ff2ad62
ExceptionCode c0000409
FaultingOffset 000000000001cba8
ProcessId 0xa4d0
ProcessCreationTime 0x1dbd34709f41b85
AppPath c:\windows\system32\inetsrv\w3wp.exe
ModulePath C:\WINDOWS\System32\ucrtbase.dll
IntegratorReportId 789362e0-4e34-48e8-9d01-7c419221a70b
PackageFullName
PackageRelativeAppId

Logs and dumps

To Reproduce

Try to upload this special image (4.5 MB, 4032 x 3024, 72dpi)

Expected behavior

No crash

Server (please complete the following information):

  • ModSecurity version v2.9.7-64b-64.msi
  • WebServer: IIS on Windows Server 2025 Datacenter, Version 24H2, Build 26100.4061

Rule Set (please complete the following information):
out of the box, without any changes

Additional context

I found https://answers.microsoft.com/en-us/windows/forum/all/windows-11-ucrtbasedll-module-error-solution/811a79cc-da02-4d65-95fc-fdec9bbc02df with hint:

1.- Open Windows Settings
2.- Navigate to Apps > Installed Apps
3.- Locate the following:
• Microsoft Visual C++ 20XX Redistributable - x64
• Microsoft Visual C++ 20XX Redistributable - x86
4.- Uninstall

and uninstalled ModSecurity.

The Upload of the image worked.

Contributor guide

No contributing guide indexed for this repository

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

No source file, test, or entry point is named, and the logs and dumps section is empty. Start by reproducing the upload on the stated ModSecurity, IIS, and Windows Server setup, then use the crash data to identify the failing component; done means the image upload completes without w3wp.exe crashing.

Written by the indexing model from the issue text.

Assessment

Tech stack
cpp, php, wordpress
Domain
backend, operating-systems, security
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
25/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.