ucrtbased.dll: Microsoft's debug C runtime, or a copy that should not be there?

What ucrtbased.dll does

The Universal C Runtime is the C library that programs built with Visual Studio 2015 and later use for files, memory, text and maths. Its release build, ucrtbase.dll, is part of Windows 10 and Windows 11. Its debug build, ucrtbased.dll, carries the same functions with extra checks and assertion dialogs that help developers find mistakes, and a program uses it when it is compiled in the Debug configuration with the /MDd option.

Microsoft documents that the debug UCRT libraries are installed with the Windows SDK, separately from the retail files, and that they are not redistributable. That is why an ordinary PC has no ucrtbased.dll at all, and why a program asking for it was published by mistake as a debug build. The file itself is harmless; the question on a PC without the SDK is who put a copy there and what came with it.

About .dll files. A .dll file is a library: it cannot run on its own and is loaded into a program's process. It does not appear in Task Manager under its own name; Process Explorer shows which process loaded it.

How to check a copy of ucrtbased.dll

Four questions decide it: whether the PC has the Windows SDK at all, where the copy is, what it says about itself and who signed it. A library never shows in Task Manager under its own name, so use these checks.

1. Find out whether the PC has Visual Studio or the Windows SDK. Open Settings, Apps, Installed apps and search for Visual Studio and Windows Software Development Kit. If neither is installed and nobody develops software on the PC, no genuine installer has put ucrtbased.dll on it.
2. List every copy and where it sits. Copies under Program Files\Windows Kits\10 are the SDK's. Look closer at copies next to a downloaded program, in a game or mod folder, in Downloads, Desktop, Temp or AppData.

   Get-ChildItem -Path C:\ -Filter ucrtbased.dll -Recurse -ErrorAction SilentlyContinue | Select-Object FullName, Length, LastWriteTime

3. Read the version resource. Microsoft's file reports Microsoft Corporation as the company and Microsoft C Runtime Library as the description, with a Windows SDK version number. Empty or different fields mean it is not Microsoft's file; matching fields can be copied, so this check alone does not clear a file.

   (Get-Item "C:\path\to\ucrtbased.dll").VersionInfo | Format-List CompanyName, FileDescription, FileVersion

4. Check the digital signature. Status Valid with a Microsoft signer means an unmodified Microsoft build. NotSigned, HashMismatch or another signer means the file is not Microsoft's as shipped.

   Get-AuthenticodeSignature "C:\path\to\ucrtbased.dll" | Format-List Status, SignerCertificate

5. Compare the checksum. Use the file check on this page. A match identifies one of the known Microsoft copies. No match is not proof of a fake, because each SDK release has its own build; the signature check above decides.

A valid Microsoft signature clears that one DLL. It says nothing about the program or download that brought a copy to a PC without the SDK, which is where any real risk sits.

Do you need ucrtbased.dll?

On a developer PC, yes: debug builds in Visual Studio need it, and the Visual Studio Installer manages it. On any other PC nothing legitimate needs it, so a copy there is a leftover from a download and can go, together with whatever brought it.

1. Leave the SDK's copies alone. Copies under Windows Kits\10 or placed by Visual Studio belong to the SDK. If one is damaged or flagged, repair Visual Studio through the Visual Studio Installer instead of deleting or replacing the file.
2. Find what brought a stray copy. Look at the folder the copy sits in and at its date. A copy next to a program or game usually came with that download; a copy in System32 on a PC without the SDK was put there by hand or by a script that followed a fix-it guide.
3. Uninstall the program it came with if you do not trust it. Open Settings, Apps, Installed apps, find the program and uninstall it. Portable programs and repacks often have no uninstaller: then delete the program's whole folder, not only ucrtbased.dll.
4. Run a Microsoft Defender full scan. Open Windows Security, Virus and threat protection, Scan options, Full scan. Quarantine what it finds. Look at Protection history afterwards for anything found in Downloads, Temp or AppData.
5. Run the offline scan if the source was a crack or a DLL site. Some malware hides while Windows runs. The offline scan restarts the PC and scans before Windows starts. It takes about 15 minutes.

   Start-MpWDOScan

6. Check what starts with Windows. Open Task Manager, Startup apps, and Task Scheduler. After the scan, disable and remove entries that run a program from AppData, ProgramData or Temp that you do not recognise.

Warning signs

Known versions of ucrtbased.dll

A public DLL catalogue lists 2 versions of ucrtbased.dll, from 10.0.10056.0 to 10.0.10056.0, by Microsoft Corporation. Its copies are uploaded by users and not verified, so a checksum match identifies the version, while the digital signature tells you whether the file is genuine. Even a genuine file clears only the file, not the folder: attackers ship genuine libraries next to a program they abuse, so where the copy sits still decides whether it is safe.

Every version with its checksums, and how to fix ucrtbased.dll errors on uGetFix

Questions people ask