Fix STATUS_SECTION_NOT_IMAGE (0xC0000049) on Windows

I know this error is infuriating. You're in the middle of something, the screen goes black or blue, and you get STATUS_SECTION_NOT_IMAGE (0xC0000049) — "An attempt was made to query image information on a section that does not map an image." It sounds like gibberish, and Microsoft's own docs barely explain it.

Here's the plain-English version: Windows tried to read a section of memory as if it were an executable image (a .exe or .dll), but that section isn't actually mapped to an image. Nine times out of ten, a system file or driver has been corrupted, or something is injecting code into a process where it doesn't belong.

This isn't random. I've seen it spike after a bad Windows Update (KB5034441 was a repeat offender), after installing certain third-party antivirus tools, and on machines where someone ran a "registry cleaner" that mangled shared DLLs. If you recently installed a cracked game trainer or an old version of a security tool, that's your smoking gun.

Let's fix it. Start with the most common cause and work down.

Cause 1: Corrupted system files (most common)

Windows stores critical executable images in C:\Windows\System32 and C:\Windows\SysWOW64. If one of those files — ntdll.dll, kernel32.dll, or a random driver — gets its header wiped or truncated, the section manager complains with 0xC0000049. A bad shutdown during an update is the classic trigger.

The fix is to repair the component store, then re-verify system files. Don't skip the DISM step — running SFC alone on a broken store often can't repair anything because the source files themselves are corrupt.

1. Right-click Start, choose Terminal (Admin) or Command Prompt (Admin).
2. Run these commands one at a time, and let each finish:

DISM /Online /Cleanup-Image /RestoreHealth
sfc /scannow

If DISM can't reach Windows Update (common on locked-down networks), point it at a mounted ISO of the same Windows build:

DISM /Online /Cleanup-Image /RestoreHealth /Source:D:\sources\install.wim /LimitAccess

Swap D: for the drive letter where you mounted the ISO. Reboot when SFC reports it fixed files. About 70% of the 0xC0000049 cases I've handled end right here.

Cause 2: A bad driver or third-party kernel hook

If SFC and DISM come back clean but the error keeps firing, a driver is loading a section that isn't a valid image. The usual suspects are old graphics drivers, out-of-date VPN clients (older NordVPN and Cisco AnyConnect builds had this), and kernel-level anti-cheat or antivirus components.

Boot into Safe Mode to confirm. If the error disappears, it's a driver. Then use Driver Verifier to pin down which one.

1. Open Command Prompt as admin and run verifier.
2. Select Create standard settings, then Automatically select all drivers.
3. Reboot. Windows will stress-test every driver and bugcheck (BSOD) on the guilty one.
4. Analyze the resulting dump in C:\Windows\Minidump with WinDbg or BlueScreenView to see the faulting module.

Once you've got the filename, roll that driver back in Device Manager or grab the vendor's latest installer. Don't trust Windows Update to give you the right build for a GPU — go straight to NVIDIA, AMD, or Intel.

Warning: Driver Verifier can leave you in a boot loop if you enable it on a machine that won't boot. If that happens, boot into WinRE and run verifier /reset from the recovery command prompt.

Cause 3: Third-party software injecting DLLs into system processes

The other big trigger is software that injects DLLs into other processes — screen readers, RGB lighting utilities, overlays (Discord, MSI Afterburner, RivaTuner), and older input remappers like AutoHotkey scripts compiled with the wrong flags. When the injected DLL's memory section doesn't match an image header, the section manager throws 0xC0000049.

You don't have to guess. Windows logs which module caused the fault in the System event log.

1. Hit Win+R, type eventvwr.msc, press Enter.
2. Go to Windows Logs → System.
3. Filter for Event ID 1001 (BugCheck) and 1000 (Application Error).
4. Look for the faulting module name in the details pane.

If it's an overlay or RGB tool, uninstall it entirely rather than just disabling it — half these tools leave a service behind. Reboot and retest. If you rely on the tool, check for a newer version; most mainstream ones fixed their injection code years ago.

Rare but real: a failing RAM stick can produce this error too, because a corrupted page in memory looks like a broken section. If the above steps don't fix it and you're seeing other random BSODs, run mdsched.exe (Windows Memory Diagnostic) overnight. Bad RAM doesn't care what your DLLs look like.

Quick-reference summary

Work through them in order. SFC + DISM handles most cases. If that fails, Safe Mode boot tells you it's a driver, and Driver Verifier names it. Injection issues show up in the event log every time — trust the log over your gut.