Program file
mfc140u.dll: is the MFC library on your PC Microsoft's own copy?
mfc140u.dll is Microsoft Foundation Classes, the Unicode library that classic Windows desktop programs use for their windows, menus and dialogs. The Visual C++ Redistributable puts it in System32 and SysWOW64, and many programs keep a copy of their own. No attack built on this name has been documented, so the questions are where your copy sits and who signed it.
Prefer to check it yourself? The manual checks follow.
An mfc140u.dll in C:\Windows\System32, C:\Windows\SysWOW64 or the folder of a program you installed, signed by Microsoft, is the genuine MFC library. It does nothing on its own: it is not a process, does not start with Windows and uses CPU only while a program that loaded it is working. Several copies on one disk are normal.
Programs search their own folder for mfc140u.dll before the Windows folders, so a file with this name placed next to a program runs inside it. Public lists of DLL hijacking candidates include mfc140u.dll for that reason. A copy in Temp, Downloads or AppData beside a program you did not install, or one without a Microsoft signature, is the case to check.
- Publisher
- Microsoft Corporation
- Description in the file
- MFCDLL Shared Library - Retail Version
- Installed by
- Microsoft Visual C++ 2015-2022 Redistributable (version 14), and by programs that bring their own MFC copy
- Current official version
- 14.51.36247.0, read from Microsoft's x64, x86 and ARM64 installers on 14 October 2026
- Size of the genuine file
- 5,597,112 bytes (x64), 4,882,368 bytes (x86) and 12,122,976 bytes (ARM64) for version 14.51.36247.0
- Genuine folders
- C:\Windows\System32 (64-bit copy), C:\Windows\SysWOW64 (32-bit copy on 64-bit Windows), and the installation folders of programs that carry their own
- Signed by
- Microsoft: Microsoft Windows Software Compatibility Publisher on the x64 and x86 builds, Microsoft Corporation on the ARM64 build
- Inside Windows images
- Five Microsoft builds, versions 14.16 to 14.40, indexed in images from Windows 10 version 1903 to Windows 11 version 25H2
- Runs as a process
- No. It is a library loaded into MFC programs
What mfc140u.dll does
MFC (Microsoft Foundation Classes) is a C++ framework that wraps the Windows interface into ready-made parts: frame windows, dialog boxes, menus, toolbars, status bars, documents and views. Programs written with it, typically engineering and design software, hardware setup tools, older business programs and utilities with a traditional look, load mfc140u.dll at startup. The u means Unicode. Its sibling mfc140.dll is the ANSI build of the same library, and files such as mfc140enu.dll hold MFC's texts in different languages.
The 140 is version 14, the line shared by Visual Studio 2015 to 2022. The genuine file exports more than 9,000 functions and depends only on Windows and on vcruntime140.dll. Because a program loads the copy in its own folder first, many installers ship mfc140u.dll there. That same search order is what makes the name usable for DLL side-loading: a different file with this name, beside a program that needs MFC, would run inside that program.
About .dll files. A .dll file is a library: it cannot run on its own and is loaded into a program's process. It does not appear in Task Manager under its own name; Process Explorer shows which process loaded it.
How to check a copy of mfc140u.dll
Location, signature and origin settle the question. A library is never listed in Task Manager under its own name, so use these checks.
- List every copy on the disk. Run this in PowerShell. System32 and SysWOW64 hold the redistributable's copies, and Program Files folders hold copies of installed programs. Any copy in Downloads, Temp or AppData deserves the next two checks.
Get-ChildItem -Path C:\ -Filter mfc140u.dll -Recurse -ErrorAction SilentlyContinue | Select-Object FullName, Length, LastWriteTime - Read the signature. A genuine copy shows Status Valid and a Microsoft signer: Microsoft Windows Software Compatibility Publisher or Microsoft Corporation. NotSigned or a different signer means the file is not Microsoft's MFC. HashMismatch means a Microsoft file that was changed after signing.
Get-AuthenticodeSignature "C:\path\to\mfc140u.dll" | Format-List Status, SignerCertificate - Compare size and checksum. Version 14.51.36247.0 is 5,597,112 bytes for x64 and 4,882,368 bytes for x86, and every genuine build is several megabytes. A file of a few kilobytes with this name cannot be MFC. Use the file check on this page to compare the SHA-256 checksum with known Microsoft builds.
- Find the program that loads it. In Process Explorer (Microsoft Sysinternals) open Find, Find Handle or DLL and type mfc140u.dll. The results show each process with the full path of the copy it loaded. A program you recognise loading its own copy is normal; an unknown program running from a user folder is not.
- Look at the folder around a copy in Temp. Programs packed into a single .exe often unpack their files into a temporary folder such as %TEMP%\_MEI followed by digits, and some of them carry mfc140u.dll there while they run. If that folder disappears when you close a program you started, it belongs to that program. If it stays and you cannot tell which program made it, scan it.
A valid Microsoft signature proves the file is Microsoft's MFC library. It does not prove that the program loading it is harmless, so judge the program in the same folder as well.
Check your mfc140u.dll
Choose the mfc140u.dll you are unsure about. Its SHA-256 and SHA-1 checksums are calculated in your browser and compared with the 13 versions of the file known from a public DLL catalogue.
The file stays on your computer. Nothing is uploaded: the checksum is computed locally.
Do you need mfc140u.dll?
Keep the signed copies in System32, SysWOW64 and the folders of programs you use: MFC programs stop starting without them. Remove a copy only together with the program it came with.
- Leave the Windows copies in place. The redistributable's mfc140u.dll in System32 and SysWOW64 serves every MFC program on the PC. Deleting it breaks those programs and removes no threat.
- Uninstall the program, not its DLL. If a copy belongs to a program you no longer want, open Settings, Apps, Installed apps, find the program and choose Uninstall. Its private mfc140u.dll goes with it.
- Move a copy you cannot explain out of the way. For an unsigned copy, or one beside an unknown .exe in a user folder, move the whole folder to a quarantine location you create, so you can restore it if something you need stops working.
- Run a Microsoft Defender full scan. Open Windows Security, Virus and threat protection, Scan options, Full scan, and quarantine what it finds before you delete anything by hand.
- Run the offline scan if the copy was unsigned. The offline scan restarts the PC and scans before Windows loads, so code hiding inside a running program cannot interfere. It takes about 15 minutes.
Start-MpWDOScan - Check what starts automatically. Look in Settings, Apps, Startup and in Task Scheduler for entries that start a program from the same folder as the suspicious copy, and remove them.
Warning signs
| What you see | What it means |
|---|---|
| mfc140u.dll in Downloads, Temp or AppData next to an .exe you did not install | A program that runs from a user folder with its own MFC copy. Check the signature of both files and scan the folder. |
| Signature status NotSigned, or a signer that is not Microsoft | The file is not Microsoft's MFC library, whatever its name says. Treat it as suspicious until you know where it came from. |
| Signature status HashMismatch | A Microsoft file altered after signing. No legitimate program needs to do that. Treat it as malicious. |
| A file named mfc140u.dll of only a few kilobytes | Genuine MFC builds are several megabytes. A tiny file with the name is a stand-in that loads something else. |
| A new folder in ProgramData or AppData holding mfc140u.dll, a signed .exe and a data file with an odd extension | The usual layout of DLL side-loading: a trusted program, a replaced library and an encrypted payload together. Scan before anything else. |
| Signed Microsoft copies in System32, SysWOW64 and several program folders | Normal. Programs and the redistributable each keep their own MFC. |
Programs that have been made to load a fake mfc140u.dll
Each program below is genuine and signed, and security researchers have documented that it can be made to load a planted mfc140u.dll. Usually the attacker copies the program into another folder and puts a fake mfc140u.dll next to it: Windows looks in the program's own folder first. A mfc140u.dll next to one of these programs, outside the folders below, is the copy to check.
Where the genuine mfc140u.dll belongs: C:\Program Files\CheckMAL\AppCheck
| Program | How |
|---|---|
C:\Program Files\CheckMAL\AppCheck\AppCheck.exeAppCheck Anti-Ransomware SHA-256 of the genuine program: ea987229c8d4e647e0b5a0d6dd08cce9d15e78f74cb5fb5c86a7e9ea6a5ecc82 | Side-loading |
Source: the HijackLibs entry for mfc140u.dll, 1 public report.
Known versions of mfc140u.dll
A public DLL catalogue lists 13 versions of mfc140u.dll, from 14.0.23026.0 to 14.25.28508.3, by Microsoft Corporation. Its copies are uploaded by users and not verified, so a checksum match identifies the version, while the digital signature tells you whether the file is genuine. Even a genuine file clears only the file, not the folder: attackers ship genuine libraries next to a program they abuse, so where the copy sits still decides whether it is safe.
Every version with its checksums, and how to fix mfc140u.dll errors on uGetFix
Questions people ask
Is mfc140u.dll a virus?
No. The genuine mfc140u.dll is Microsoft's MFC library and is harmless; it is signed by Microsoft and installed by the Visual C++ Redistributable or by the programs that use it. As of October 2026 no malware campaign built on this file name has been documented. A program loads the copy in its own folder first, though, so the name could be misused. Check the folder and the signature of a copy you are unsure about.
Why do I have so many copies of mfc140u.dll?
Each MFC program may install its own copy next to its .exe so that it works even without the redistributable, and Windows components carry private builds as well. Ten copies on one disk are not unusual. Copies signed by Microsoft inside Program Files or the Windows folders are fine. Only a copy in a user folder next to a program you do not know needs a closer look.
Why is there an mfc140u.dll in my Temp folder?
Programs packed into a single .exe unpack their parts into a temporary folder while they run, often named _MEI followed by digits, and some carry MFC with them. The folder normally vanishes when the program closes. A copy that stays in Temp after every program is closed, or that sits next to an unknown .exe, is worth a signature check and a Microsoft Defender scan.
My antivirus flagged a program that includes mfc140u.dll. Is the DLL infected?
Usually not. Scanners judge the whole program, and a detection names the folder or archive where the genuine MFC library also sits. Check the signature of mfc140u.dll itself: if it is valid and from Microsoft, the DLL is fine and the detection is about another file in the same folder. If the DLL is unsigned or shows HashMismatch, it is part of the problem.
What is the difference between mfc140u.dll and mfc140.dll?
They are the Unicode and the ANSI builds of the same MFC library, version 14. Unicode programs, the large majority, load mfc140u.dll; older programs that work with code pages load mfc140.dll. Both are Microsoft files from the same redistributable and both are checked the same way: a Microsoft signature and a known folder mean genuine.
Can I delete mfc140u.dll?
Not the signed copies in System32, SysWOW64 or the folders of programs you use, because the MFC programs that rely on them would no longer start. A copy that belongs to a program you want gone disappears when you uninstall that program from Settings, Apps. Delete a copy outside any program folder only after a Microsoft Defender full scan has checked it.
Sources
- Microsoft Learn: Latest supported Visual C++ Redistributable downloads
- Winbindex, the Windows binaries index: mfc140u.dll
- MITRE ATT&CK T1574.001: Hijack Execution Flow: DLL
- List of DLL hijacking candidates including mfc140u.dll (GitHub)
- Microsoft Learn: Get-AuthenticodeSignature
Version data read on Oct 14, 2026.
Questions and experiences
Ask about this page: members and our editors answer. Reading is open; writing needs a free account.
…