Fix ERROR_INVALID_EXE_SIGNATURE (0X000000BF) on Windows 10/11

What causes ERROR_INVALID_EXE_SIGNATURE (0X000000BF)?

I know seeing "Cannot run %1 in Win32 mode" is maddening — especially when you're just trying to launch a tool you've used for months. This error hits most often after a Windows update or a third-party antivirus installation. The system is saying the executable's digital signature is missing or invalid. Let's fix it.

Cause 1: Corrupt system files (most common)

This error usually means a core Windows component (like kernel32.dll or ntdll.dll) got borked by a failed update. I've seen it happen right after a Windows 10 22H2 feature update. The fix is straightforward.

1. Open Command Prompt as administrator. Hit Win+R, type cmd, press Ctrl+Shift+Enter.
2. Run sfc /scannow. This checks all protected system files and replaces bad ones from a cached copy. It takes 10-20 minutes.
3. If SFC finds issues but can't fix them (which happens often), run DISM /Online /Cleanup-Image /RestoreHealth. DISM pulls fresh files from Windows Update. This one can take 30 minutes.
4. Reboot and try launching the app again.

In my experience, SFC alone fixes about 60% of 0x000000BF cases. DISM handles another 20%. If you're still stuck, move to the next cause.

Cause 2: Corrupt registry keys (underrated cause)

Windows stores signature verification flags in the registry. A bad entry in HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\Executive can block all executables. This tripped me up on a Windows 11 23H2 machine last year.

Warning: Editing the registry wrong can break your system. Back it up first (File > Export in regedit).

1. Open regedit (Win+R, type regedit).
2. Go to HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\Executive.
3. Look for a DWORD named ExcludeFromKnownDLLs. If it exists and has a value other than 0, that's your problem. Delete it or set it to 0.
4. Also check HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options. Look for a subkey matching your app's name (e.g., notepad.exe). If it has a Debugger value pointing to a non-existent path, delete that subkey.
5. Restart your PC.

I've seen machines where a third-party tool added a bogus Debugger key. Removing it kills the error instantly.

Cause 3: Anti-malware or security software interference

Some antivirus suites (I'm looking at you, older versions of McAfee and Bitdefender) hook into the Windows image loader to check signatures. When they mess up, they can falsely flag valid executables.

1. Temporarily disable your antivirus. Don't just turn off real-time scanning — fully disable it or uninstall it (you can re-enable after).
2. Try launching the app again. If it works, you've found the culprit.
3. Reinstall the latest version of your antivirus software. Or switch to Windows Defender — it's actually good now and doesn't cause this error.

If disabling the antivirus doesn't help, check Windows Defender's tamper protection. Go to Windows Security > Virus & threat protection > Manage settings. Turn off Real-time protection temporarily. If the error stops, you need to add an exclusion for the app's folder.

Quick-reference summary

If none of these work, you might be dealing with a genuinely corrupted executable. Download a fresh copy from the official source. And if it's a game or critical business app, check for a 64-bit version — the error says "cannot run in Win32 mode," which sometimes means the 32-bit version is incompatible with your 64-bit OS due to a driver issue.

One last thing: if you're on a corporate-managed device, Group Policy could be enforcing signature requirements. That's a conversation for your IT admin.