owasp-modsecurity / owasp-modsecurity/ModSecurity
2,9,7 Appl Error 1000 in w3wp.exe Module ucrtbase.dll
Nobody has claimed this yet.
- Dominant language
- C++
- Stars
- 9.8k
- Forks
- 1.8k
- Avg merge
- 2h 46m
- Merged PRs (30d)
- 1
Description
I uploade an image on WordPress 6.8.1 / PHP 8.4. 7 / Win Srv 2025 and IIS crashes. I tried it several times, always the same result
AppName w3wp.exe
AppVersion 10.0.26100.1882
AppTimeStamp c6bd45bd
ModuleName ucrtbase.dll
ModuleVersion 10.0.26100.4061
ModuleTimeStamp 8ff2ad62
ExceptionCode c0000409
FaultingOffset 000000000001cba8
ProcessId 0xa4d0
ProcessCreationTime 0x1dbd34709f41b85
AppPath c:\windows\system32\inetsrv\w3wp.exe
ModulePath C:\WINDOWS\System32\ucrtbase.dll
IntegratorReportId 789362e0-4e34-48e8-9d01-7c419221a70b
PackageFullName
PackageRelativeAppId
Logs and dumps
To Reproduce
Try to upload this special image (4.5 MB, 4032 x 3024, 72dpi)
Expected behavior
No crash
Server (please complete the following information):
- ModSecurity version v2.9.7-64b-64.msi
- WebServer: IIS on Windows Server 2025 Datacenter, Version 24H2, Build 26100.4061
Rule Set (please complete the following information):
out of the box, without any changes
Additional context
I found https://answers.microsoft.com/en-us/windows/forum/all/windows-11-ucrtbasedll-module-error-solution/811a79cc-da02-4d65-95fc-fdec9bbc02df with hint:
1.- Open Windows Settings
2.- Navigate to Apps > Installed Apps
3.- Locate the following:
• Microsoft Visual C++ 20XX Redistributable - x64
• Microsoft Visual C++ 20XX Redistributable - x86
4.- Uninstall
and uninstalled ModSecurity.
The Upload of the image worked.
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
No source file, test, or entry point is named, and the logs and dumps section is empty. Start by reproducing the upload on the stated ModSecurity, IIS, and Windows Server setup, then use the crash data to identify the failing component; done means the image upload completes without w3wp.exe crashing.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- cpp, php, wordpress
- Domain
- backend, operating-systems, security
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 25/100