2,9,7 Appl Error 1000 in w3wp.exe Module ucrtbase.dll

[FrankWarius]

I uploade an image on WordPress 6.8.1 / PHP 8.4. 7 / Win Srv 2025 and IIS crashes. I tried it several times, always the same result

AppName w3wp.exe
AppVersion 10.0.26100.1882
AppTimeStamp c6bd45bd
ModuleName ucrtbase.dll
ModuleVersion 10.0.26100.4061
ModuleTimeStamp 8ff2ad62
ExceptionCode c0000409
FaultingOffset 000000000001cba8
ProcessId 0xa4d0
ProcessCreationTime 0x1dbd34709f41b85
AppPath c:\windows\system32\inetsrv\w3wp.exe
ModulePath C:\WINDOWS\System32\ucrtbase.dll
IntegratorReportId 789362e0-4e34-48e8-9d01-7c419221a70b
PackageFullName
PackageRelativeAppId

Logs and dumps

To Reproduce

Try to upload this special image (4.5 MB, 4032 x 3024, 72dpi)

Expected behavior

No crash

Server (please complete the following information):

• ModSecurity version v2.9.7-64b-64.msi
• WebServer: IIS on Windows Server 2025 Datacenter, Version 24H2, Build 26100.4061

Rule Set (please complete the following information):
out of the box, without any changes

Additional context

I found https://answers.microsoft.com/en-us/windows/forum/all/windows-11-ucrtbasedll-module-error-solution/811a79cc-da02-4d65-95fc-fdec9bbc02df with hint:

1.- Open Windows Settings
2.- Navigate to Apps > Installed Apps
3.- Locate the following:
• Microsoft Visual C++ 20XX Redistributable - x64
• Microsoft Visual C++ 20XX Redistributable - x86
4.- Uninstall

and uninstalled ModSecurity.

The Upload of the image worked.

[airween]

Hi @FrankWarius,

I think if the cause is the module, then we can reproduce it on other platform too. Could you sent the file which triggers this error to modsecurity@owasp.org?

[FrankWarius]

why do ship and install such an old MS Visual c++ version.

i primary use

• MS Visual c++ 2015-2002 x64 /x32 14.44.35208
  also installed
• 2010 x64/x32 10.0.40219
• 2008 x64/x32 9.0.30729.6161

[airween]

Sorry, I don't have any Windows system.

[FrankWarius]

I uninstalled the old versions of VS Visual C++ (2008 / 2020), so only 2015-2022 left and reinstalled modsecurity.
no old c++ version was installed
but error still exists.

[dune73]

Photo got here just find. Thanks.

[airween]

I tried to upload the given file, and I couldn't reproduce your issue.

Could you show the request (eg. a curl command) what triggers the problem?

[FrankWarius]

I am using Wordpres 6.8.1 with PHP 8.4.8 on Windows NT Server 10.0 build 26100 (Windows Server 2025) AMD64.

i am using Drag and Drop (on the server)

Wordpress returns

Windows Application log

[-](file:///C:/Users/Frank0/AppData/Local/Temp/tmp63B6.xml#) <Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
[-](file:///C:/Users/Frank0/AppData/Local/Temp/tmp63B6.xml#) <System>
  <Provider Name="Application Error" Guid="{a0e9b465-b939-57d7-b27d-95d8e925ff57}" /> 
  <EventID>1000</EventID> 
  <Version>0</Version> 
  <Level>2</Level> 
  <Task>100</Task> 
  <Opcode>0</Opcode> 
  <Keywords>0x8000000000000000</Keywords> 
  <TimeCreated SystemTime="2025-06-12T05:35:40.0763552Z" /> 
  <EventRecordID>96498</EventRecordID> 
  <Correlation /> 
  <Execution ProcessID="6232" ThreadID="7624" /> 
  <Channel>Application</Channel> 
  <Computer></Computer> 
  <Security UserID="S-1-5-82-1754458973[-](file:///C:/Users/Frank0/AppData/Local/Temp/tmp63B6.xml#)596927587-710158445-1930058573-3489007940" /> 
  </System>
- <EventData>
  <Data Name="AppName">w3wp.exe</Data> 
  <Data Name="AppVersion">10.0.26100.1882</Data> 
  <Data Name="AppTimeStamp">c6bd45bd</Data> 
  <Data Name="ModuleName">ucrtbase.dll</Data> 
  <Data Name="ModuleVersion">10.0.26100.4202</Data> 
  <Data Name="ModuleTimeStamp">32a4a0e5</Data> 
  <Data Name="ExceptionCode">c0000409</Data> 
  <Data Name="FaultingOffset">000000000001cba8</Data> 
  <Data Name="ProcessId">0x2b38</Data> 
  <Data Name="ProcessCreationTime">0x1dbdb38ffc3e818</Data> 
  <Data Name="AppPath">c:\windows\system32\inetsrv\w3wp.exe</Data> 
  <Data Name="ModulePath">C:\WINDOWS\System32\ucrtbase.dll</Data> 
  <Data Name="IntegratorReportId">0449aa96-d846-4571-8595-4bcd7293f477</Data> 
  <Data Name="PackageFullName" /> 
  <Data Name="PackageRelativeAppId" /> 
  </EventData>
  </Event>

IIS Log

05:31:01 | ip | POST | /wp-admin/admin-ajax.php | - | 443 | - | ip | Mozilla/5.0+(Windows+NT+10.0;+Win64;+x64) | https://xxx.yyy.de/wp-admin/upload.php | 200 | 0 | 0 | 586
05:32:01 | ip | POST | /wp-cron.php | doing_wp_cron | 443 | - | ip | WordPress/6.8.1;+https://xxx.yyy.de | - | 200 | 0 | 0 | 346
05:32:01 | ip | POST | /wp-admin/admin-ajax.php | - | 443 | - | ip | Mozilla/5.0+(Windows+NT+10.0;+Win64;+x64) | https://xxx.yyy.de/wp-admin/upload.php | 200 | 0 | 0 | 726
05:34:02 | ip | POST | /wp-cron.php | doing_wp_cron | 443 | - | ip | WordPress/6.8.1;+https://xxx.yyy.de | - | 200 | 0 | 0 | 234
05:34:02 | ip | POST | /wp-admin/admin-ajax.php | - | 443 | - | ip | Mozilla/5.0+(Windows+NT+10.0;+Win64;+x64) | https://xxx.yyy.de/wp-admin/upload.php | 200 | 0 | 0 | 568
05:35:02 | ip | POST | /wp-cron.php | doing_wp_cron | 443 | - | ip | WordPress/6.8.1;+https://xxx.yyy.de | - | 200 | 0 | 0 | 287
05:35:02 | ip | POST | /wp-admin/admin-ajax.php | - | 443 | - | ip | Mozilla/5.0+(Windows+NT+10.0;+Win64;+x64) | https://xxx.yyy.de/wp-admin/upload.php | 200 | 0 | 0 | 606
05:36:31 | ip | POST | /wp-admin/admin-ajax.php | - | 443 | - | ip | Mozilla/5.0+(Windows+NT+10.0;+Win64;+x64) | https://xxx.yyy.de/wp-admin/upload.php | 500 | 0 | 64 | 30003
05:37:34 | ip | POST | /wp-admin/admin-ajax.php | - | 443 | - | ip | Mozilla/5.0+(Windows+NT+10.0;+Win64;+x64) | https://xxx.yyy.de/wp-admin/upload.php | 500 | 0 | 64 | 30025

If ModSecurity is uninstalled, the upload works.

[FrankWarius]

I just tried to upload a pdf with 12 MB, Same error.

I guess, that the Windows handling of oversized uploads run into this error.

[airween]

Could you check the SecRequestBodyLimit value? I know your image's size is "only" 4.6MB, but to be sure...

Btw when a client uploads a file, it converts that into BASE64 format, which has a bigger size. The multiplier is 4/3, so if your file is 1MB, the base64 encoded data will be 1.33 MB. And you should set this value (or a bit higher) as SecRequestBodyLimit.

Other question: are you able to configure debug.log in IIS? If yes, please do that, and share the debug log (in private - send it to the mail address) when you upload that file.

[FrankWarius]

it's an evaluation installation "out of the 2.9.7 box" without any changes

SecRuleEngine DetectionOnly
SecRequestBodyAccess On
SecStreamInBodyInspection On
SecRule REQUEST_HEADERS:Content-Type "(?:application(?:/soap\+|/)|text/)xml" \
     "id:'200000',phase:1,t:none,t:lowercase,pass,nolog,ctl:requestBodyProcessor=XML"
SecRule REQUEST_HEADERS:Content-Type "application/json" \
     "id:'200001',phase:1,t:none,t:lowercase,pass,nolog,ctl:requestBodyProcessor=JSON"
SecRequestBodyLimit 13107200
SecRequestBodyNoFilesLimit 131072
SecRequestBodyInMemoryLimit 131072
SecRequestBodyLimitAction Reject

[FrankWarius]

What do you mean by iis Debug.log?

advanced logging is enabled, but there are no error logs for this site, 500 errors from other sites are logged.

do the WER reports help?

...
\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER.1315c7d1-9d96-4bf0-a7f9-dce5e5933d3c.tmp.dmp
\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER.431815de-9c66-468d-865a-95a761292e04.tmp.WERInternalMetadata.xml
\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER.c81ac5a9-d57c-4beb-bf84-58cdd4711110.tmp.csv
\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER.a89d57ec-15bd-4a27-9f34-858145c21d08.tmp.txt
...

[FrankWarius]

I set advanced Logging to response code 200-999 and got only 2 log files with code 200, but no 500

<failedRequest url="https://xxx.yyy.de:443/wp-cron.php?doing_wp_cron=1749736050.9177498817443847656250"
               siteId="5"
               appPoolId="PHPProd"
               processId="9004"
               verb="POST"
               remoteUserName=""
               userName=""
               tokenUserName="NT-AUTORITÄT\IUSR"
               authenticationType="anonymous"
               activityId="{40000012-0002-ED00-B63F-84710C7967BB}"
               failureReason="STATUS_CODE"
               statusCode="200"
               triggerStatusCode="200"
               timeTaken="375"
               xmlns:freb="http://schemas.microsoft.com/win/2006/06/iis/freb"
               >

<failedRequest url="https://www.yyy.de:443/wp-admin/admin-ajax.php"
               siteId="5"
               appPoolId="PHPProd"
               processId="9004"
               verb="POST"
               remoteUserName=""
               userName=""
               tokenUserName="NT-AUTORITÄT\IUSR"
               authenticationType="anonymous"
               activityId="{40000036-0000-DE00-B63F-84710C7967BB}"
               failureReason="STATUS_CODE"
               statusCode="200"
               triggerStatusCode="200"
               timeTaken="1859"
               xmlns:freb="http://schemas.microsoft.com/win/2006/06/iis/freb"
               >

[airween]

What do you mean by iis Debug.log?

advanced logging is enabled, but there are no error logs for this site, 500 errors from other sites are logged.

do the WER reports help?

May be.

Could you zip them and send it via e-mail?