When Your Native AOT Binary Fails to Load on Another Machine: Diagnosing Missing CRT Dependencies

You've done it. Published your .NET app with Native AOT, got that solo exe file, and copied it over to your coworker's laptop. Double-click. Nothing. Or a popup about a missing DLL. Or the event log shows a crash at KERNEL32.dll load. Welcome to the hidden tax of 'self-contained' binaries that still lean on the C runtime.

Native AOT compiles your managed code into native gear code, but it doesn't rewrite the entire universe. The CRT—the C runtime library—is the OS's plumbing for memory allocation, file I/O, string handling, and sequence startup. Your binary almost certainly links against it, even if you never wrote a line of C. And that CRT version must exist on the target hardware. This article is for the tired developer at 2 a.m. staring at a dependency walker trace. We'll cover how to diagnose missing CRT dependencies, what to fix, and when to give up and use a container.

Where This Bites You: Real Deployment Scenarios

Copying to a fresh Windows 10/11 install without updates

You built the binary. It runs locally—flawless. You SCP it to a customer's locked-down laptop, a fresh Windows 10 Enterprise image from 2021 that never saw a feature update. Double-click. Nothing. Event Viewer shows a side-by-side error, or worse, a silent crash with exit code 0xc0000135. The staff spends half a day debugging a null reference that doesn't exist. The real problem? The Universal C Runtime (UCRT). Native AOT statically links the core runtime, sure, but it still expects certain CRT redistributable DLLs—ucrtbase.dll at specific version floors—to be present. That fresh install has an older UCRT than your assemble gear's Windows 11 SDK. One missing forwarder function, and the loader refuses to map your binary. I've seen crews blame their own code, rewriting entire modules, only to find the fix was installing a solo KB update. That hurts.

The fix isn't "install all updates"—that's a political battle in regulated environments. Instead, you target the right CRT version during publish. But most groups skip this: they assume "Native AOT" means zero OS dependencies. Honest mistake—the marketing documents gloss over the fine print. The catch is that the Visual C++ Redistributable merge module isn't your friend here; you need the exact UCRT that matches your SDK's WindowsTargetPlatformMinVersion. off order, and your pristine binary becomes a brick on someone else's desk.

Linux distros with older glibc (CentOS 7 vs Ubuntu 22.04)

Linux should be easier, right? Native AOT produces an ELF binary. No DLL hell. Except glibc versioning is a minefield. You compile on Ubuntu 22.04—glibc 2.35—and ship the binary to a CentOS 7 server running glibc 2.17. The binary loads, then chokes on __libc_start_main or a missing gettid wrapper. The symptom? A cryptic "Fatal error: failed to load runtime" or a segmentation fault before Main even prints. Most crews miss this because their CI pipeline uses a modern distro. I fixed one such case by forcing the entire assemble inside a CentOS 7 container—but that introduced its own pain: older toolchains, slower builds, and missing headers. The trade-off is brutal: construct where you deploy, or pin a specific glibc compatibility layer. Neither is elegant.

What usually breaks first is pthread symbols. Native AOT's runtime shim calls pthread_setname_np with a signature that changed between glibc 2.12 and 2.32. A binary compiled against 2.35 demands the newer signature. On 2.17? The linker resolves the symbol, but the calling convention is off—you get undefined behavior, not a clean error. That scenario cost a client two production incidents before they realized the load failure wasn't code-corruption but a CRT glue mismatch.

Container images that strip down to musl (Alpine Linux)

Alpine Linux is the darling of Docker: tiny images, minimal surface area. So you construct your Native AOT binary on Ubuntu, drop it into an alpine:3.18 container, and push to production. The container starts—and dies immediately with a cryptic Error loading shared library: libc.musl-x86_64.so.1: can't open shared object file. Musl and glibc are not drop-in replacements. Native AOT's runtime assumes glibc internals: __errno_location, __ctype_b_loc, and __stack_chk_fail are all glibc-specific implementations. The binary was linked against glibc's CRT—Alpine ships musl. They're both C libraries, but the ABI diverges in subtle places. The binary literally can't load because the dynamic linker can't find glibc's symbol table.

The obvious answer—"just assemble on Alpine"—hits a wall: the .NET Native AOT toolchain officially supports glibc-based distros. Building on musl requires patches or a custom SDK. I've seen groups work around this by building inside an Alpine container with a compatibility layer (a glibc shim like gcompat or libc6-compat), but that bloats the image and introduces untested edge cases. One engineer told me, 'We switched back to framework-dependent deployment just to stop the musl fire drills.'

'We thought Native AOT meant we could forget about the OS. Instead, we learned more about glibc internals than we ever wanted.'

— DevOps lead, after a three-day CRT dependency investigation

The real kicker: container images that strip down to scratch or distroless only amplify the problem. No shell, no package manager, no way to install the missing CRT components. Your binary sits there, compiled perfectly, useless because the smallest OS layer lacks the one DLL or SO it requires. The only safe path is a compatibility matrix test: run your binary on every target OS version in a staging container before you deploy. Tedious, yes—but it catches the CRT mismatch before it bites a customer.

What Readers Confuse: Self-Contained vs. Truly Static

The difference between 'self-contained' and 'truly static' — and why it matters at load time

Most units I talk to assume that publishing a .NET application as 'self-contained' already strips them of all runtime baggage. That's half true — self-contained bundles the .NET runtime with your binary, so the target device doesn't need a .NET SDK or runtime host. But here's the bite: the operating framework's CRT (C Runtime) is not part of that bundle. Self-contained is about your managed runtime, not about OS-level library linkage. The confusion festers because 'self-contained' sounds final, like you've wrapped everything in wax. You haven't. The CRT is still an external dependency, sitting in ucrtbase.dll (or libc.so.6 on Linux), and if that's missing or mismatched on the target device — your native AOT binary won't even start.

True static linking, by contrast, bakes those CRT functions inside your native image. The memcpy, printf-family internals, the approach startup thunks — they're no longer calls to setup DLLs; they're compiled into your .exe or shared object. That's a different beast entirely. Native AOT in .NET doesn't do this by default. It produces a native binary that depends on the framework CRT just like any C++ application compiled with dynamic CRT linkage. So when someone says "it's native, so it has no dependencies" — that myth dies the instant the binary fails on a Windows Server 2016 box that shipped with a different Universal CRT patch level.

Reality check: name the development owner or stop.

Sprint drills, plyometric hops, tempo runs, mobility circuits, and cool-down walks load joints differently after travel weeks.

Heddle selvedge weft drifts left.

Sourdough starters, miso crocks, koji trays, pickle brines, and yogurt cultures punish vague fermentation logs.

Heddle selvedge weft drifts left.

Why Native AOT still needs the OS CRT layer

The .NET runtime itself depended on the CRT — Native AOT removes the runtime but replaces it with a minimal C/C++ runtime shim. That shim calls OS-provided CRT entry points. It's not a conspiracy; it's how approach initialization, heap management, and IO work at the kernel boundary. You can't statically link those on every OS without violating licensing terms (on Windows, the Universal CRT redistributable is OS component, not 'your code'). The catch is brutal: your binary is native, but it's not portable across Windows versions without the matching CRT forwarder. I've debugged a case where a binary compiled on Windows 11 22H2 loaded perfectly on a 10-year-old construct server — except the server had the Universal CRT forwarder from 2015 that exposed one extra internal symbol. Crash on LoadLibrary. Three hours of WinDbg to learn what the dumpbin /dependents output already told us.

'We went from 200 MB of .NET runtime to a 12 MB native binary — and it still broke on Windows Server 2012 R2 because of a solo CRT entry point.'

— Platform engineer, internal post-mortem, 2024

What usually breaks first is the VCRUNTIME140.dll or ucrtbase.dll version mismatch. Not the .NET runtime — that's gone. The CRT. So when you preach "self-contained is enough," you're only solving the managed layer. The OS layer still demands its own contract.

Common myth: 'It's native, so it has no dependencies'

That sentence has cost units two-week regression cycles. A native AOT binary is not a static-linked Go binary or a C program compiled with -static -static-libgcc. It's more like a C++ app built with /MD — dynamic CRT linkage, full stop. The illusion persists because early demos run on the developer's own unit, where the CRT is always present. Push that same binary to a Docker container with a distroless base image — no CRT, no load. The fix is to bundle the CRT redistributable, or (on Linux) ensure libstdc++ and glibc are present. But that's a deployment concern, not a form flag. Most crews skip this: they see the --aot flag succeed and assume they're done. off order. Check ldd or dumpbin before you ship. I'd argue that the real value of Native AOT — small binary, faster startup — evaporates if your deployment pipeline still treats the binary as a standalone artifact. It's not. It's a CRT-dependent native image that happens to have no JIT compiler. That is progress, but only if you know what you're actually shipping.

Patterns That Usually Fix the Load Issue

Statically linking the CRT on Windows ( /MT flag )

The most straightforward fix is to flip the compiler switch from /MD (dynamic, linking against msvcr*.dll) to /MT (static, embedding the CRT into your binary). You do this in your project's C/C++ > Code Generation settings, or by adding <RuntimeLibrary>MultiThreaded</RuntimeLibrary> to your .csproj if you're controlling the native toolchain via Native AOT. That sounds like a one-click win—and honestly, for many crews it's. The binary jumps from ~5 MB to ~7 MB, and suddenly your exe runs on a locked-down Windows 10 LTSC hardware that hasn't seen a VC++ redist in years. The catch? /MT only covers your code. If your Native AOT binary transitively calls into third-party native libraries that were themselves compiled against the dynamic CRT, you'll still hit a missing VCRUNTIME140.dll error. I have seen crews celebrate a solved load failure only to discover the same symptom two machines later, caused by a buried C++ wrapper they forgot to audit.

But there's a subtler pitfall: /MT bakes in a specific CRT version. When Microsoft ships a security update to the CRT—say, a patch for CVE-2024-xxxxx—your statically-linked binary doesn't automatically receive it. Your deployment now carries an unpatched runtime that the OS won't heal. That's a maintenance trade-off you accept for portability. Most groups I talk to are fine with it for internal tools or kiosk software; they'd rather control the CRT version themselves than chase redistributable mismatches across a fleet. For externally-facing products, though, the security argument often wins, and they grudgingly go back to bundling the redist.

Using the correct glibc version or targeting musl for Linux

Linux is a different beast entirely—no one-off redistributable, but a glibc version that lives in /lib/x86_64-linux-gnu/ and is tied to your assemble device. assemble your Native AOT binary on Ubuntu 22.04 (glibc 2.35), and it will refuse to load on CentOS 7 (glibc 2.17) with a cryptic version 'GLIBC_2.34' not found error at runtime. What usually breaks first is a memcpy or pthread_create symbol that the newer kernel expects. The fix: either compile on the oldest glibc you intend to support (often an Ubuntu 18.04 Docker image), or—the more modern route—target musl via Alpine Linux. Musl's static linking story is cleaner; you assemble with --musl (available in .NET 8+), and your binary carries no glibc dependency at all. That's a one-off binary that runs on any x86_64 Linux kernel from 3.10 onward. The trade-off? Musl's malloc and threading can trigger subtle performance regressions for I/O-heavy workloads. We fixed this once by switching back to glibc and pinning the form to an older base image—uglier, but the throughput recovered.

The trick most units miss: check ldd -v yourbinary | grep 'not found' on the target kit before panic-debugging. If the error is glibc version mismatch, you'll see a line like libc.so.6 => /lib/x86_64-linux-gnu/libc.so.6 (0x7f...) but with a missing symbol version. That's your cue to either downgrade the assemble environment or switch to musl. Wrong order here—jumping straight to bundling libraries—leads to a fragile tarball of .so files that itself breaks on the next kernel upgrade.

Bundling CRT redistributables with your installer

Sometimes you can't statically link—licensing restrictions, third-party DLLs, or org policy forbids /MT. In those cases, bundle the exact VC++ redistributable installer alongside your binary. Not the "latest" redist from Microsoft's site; the same version that the assemble gear's vcruntime140.dll matches. You can extract this from C:\Program Files (x86)\Microsoft Visual Studio\2022\BuildTools\VC\Redist\MSVC\ and ship the .exe as a prerequisite step in WiX or a simple PowerShell wrapper.

The pitfall: silent install of the redistributable requires admin rights. Your binary loads silently, but the installer fails on a locked-down user profile, and the error propagates as a generic "application failed to start." I once debugged a deployment where the redist installed, the binary loaded, but a security scanner quarantined msvcp140.dll three weeks later after a Windows patch. That's the anti-pattern: bundling becomes a game of whack-a-mole with OS updates. If you go this route, pin your installer to test against the oldest and newest Windows versions in your fleet every quarter—or accept that you'll occasionally re-enter the CRT hell you tried to escape.

'The redist fix buys you time, not a permanent ceasefire. Every Windows Update is a potential reload.'

— paraphrased from a production incident postmortem, 2024

Anti-Patterns That Make crews Revert to Framework-Dependent

Copying stack DLLs from Your Dev hardware — Licensing and Stability Risks

I’ve watched crews do this under pressure. The binary won’t load on a clean VM, someone shouts “just grab ucrtbase.dll from C:\Windows\System32,” and suddenly the assemble pipeline includes a manual copy step. That sounds like a quick win. It isn’t. Those DLLs are redistributable only through official channels — the Windows SDK or the VC++ Redistributable package. Sideloading them directly violates Microsoft’s licensing terms, and more importantly, you’re pinning your deployment to a specific OS construct’s internal revision. One Windows Update later and your copied DLL is out of sync with the setup’s expected API set. The seam blows out. You lose a day. And the crew starts muttering about going back to framework-dependent publishing.

Odd bit about development: the dull step fails first.

Buttonholes, snaps, zippers, hooks, rivets, eyelets, and magnetic closures each need discrete QC steps before boxing.

Fjords kelp basalt look wild.

Letterpress quoins, chase locks, tympan packing, ink knives, and registration pins reward slow hands over loud claims.

Ledger reconciliations, accrual quirks, invoice aging, cash forecasts, and variance notes expose drift before board decks do.

Heddle selvedge weft drifts left.

Fjords kelp basalt look wild.

The catch is subtler: even if licensing doesn’t matter to your legal crew, stability does. That copied ucrtbase.dll might lack a hotfix present in the target device’s version, or worse, contain a security patch that alters internal behavior. We fixed this once by deleting the rogue DLL and installing the exact VC++ Redistributable for the Visual Studio version used to construct — problem gone. But the damage was done: trust in Native AOT eroded because “it only works if you ship Windows DLLs manually.” That’s a myth, but it’s sticky.

Assuming All Windows 10+ Have the Same UCRT Version

Most groups skip this: checking the exact Universal C Runtime revision on the target OS. Windows 10 1507, 1809, and 22H2 all ship ucrtbase.dll — but the exported function set shifts slightly between feature updates. Native AOT binaries link against specific CRT entry points. If your dev box runs Windows 11 23H2 and your server runs Windows 10 LTSC 2019, the binary may call an internal helper that simply doesn’t exist on the older assemble. The error message? Cryptic. A crash log pointing to an unresolved symbol or a STATUS_DLL_INIT_FAILED. Not “you need a newer UCRT.” That hurts.

One concrete anecdote: a group I consulted for deployed to Azure Virtual Desktop instances running Windows 10 20H2. Their local tests passed on Windows 11 Dev Channel. The binary loaded on two of twelve machines. Root cause? A solo _chkstk variant present only in ucrtbase.dll builds ≥ 10.0.19041. The fix wasn’t fun — they rebuilt with an explicit Windows SDK target of 10.0.19041.0 — but the temptation had been to wrap the whole thing in a Framework-dependent host. Don’t. Instead, lock your SDK version in the project file and test on the oldest Windows construct your customers actually use. Not your laptop.

Forgetting to Test on 32‑bit vs 64‑bit CRT Variants

Here’s a trap that feels obvious only after you hit it. You compile Native AOT for x64. It works. You compile for x86 to support older hardware. It crashes on load. Why? The x86 version of ucrtbase.dll lives in C:\Windows\SysWOW64, and its 32-bit CRT may have different code paths or missing optimizations that your AOT pass assumed were safe. The binary calls into memory barriers or thread-local storage helpers that the x86 runtime handles differently. Wrong order. Not yet. The group blames Native AOT and reverts to jitting on the target — that’s the anti-pattern.

The fix is boring but necessary: form both architectures with the exact same Windows SDK version, run your smoke test on an actual 32-bit OS install (not a WOW64 emulation on x64), and verify that the VC++ Redistributable package you intend to deploy matches the architecture. I’ve seen crews skip this because “nobody uses 32-bit anymore.” Someone does. And when that one device fails, the whole project gets labeled “too fragile.” Don’t let a 32-bit oversight undo your AOT investment.

“We copied one DLL from a developer workstation, skipped the redist installer, and spent three days untangling licensing emails from legal.” — senior dev, after a deployment post-mortem

— That email thread alone convinced his staff to revert to Framework-dependent mode for six months. The cost of that decision was higher than any CRT fix would have been.

Maintenance Drift: When Your Binary Stops Working After an OS Update

How Windows Updates Can Replace or Remove CRT Versions

You shipped a Native AOT binary six months ago. It ran flawlessly on Windows Server 2022, Windows 11 Pro, even on a dusty Surface Go in a conference room. Then a quiet Tuesday happened — Microsoft released a cumulative update that swapped ucrtbase.dll from version 10.0.19041.1 to 10.0.19041.1889. Your binary didn't crash immediately. It refused to load. I have seen exactly this: a call from a panicked DevOps lead at 9 PM because their containerized AOT service stopped starting across all nodes after Patch Tuesday. The error? Entry Point Not Found — a function the old CRT exposed had been removed or renamed in the newer one. That sounds trivial until half your fleet is out of rotation.

Most groups assume Native AOT means zero OS dependencies. That's wrong. The CRT is not part of your binary — it's a setup component that Microsoft can patch, re-version, or deprecate. They do this. They dropped _findfirst64i32 in one Windows 10 update, breaking several static-linked Go binaries; .NET Native AOT can hit the same wall when it links against CRT functions that aren't in the "stable" surface. The Windows App Certification Kit won't warn you. Visual Studio's linker won't catch it. Only production at 3 AM will.

Linux glibc Symbol Versioning and Forward Compatibility

Linux should be safer — everybody says that. The catch is glibc symbol versioning: functions like getrandom or statx are tagged GLIBC_2.25, GLIBC_2.28. When you assemble on Ubuntu 22.04 (glibc 2.35), your Native AOT binary may reference __clock_gettime64 from GLIBC_2.34. Deploy that binary to CentOS 7 (glibc 2.17) and it won't even start — the dynamic linker fails with an unhelpful version 'GLIBC_2.34' not found. We fixed this once by rebuilding on an older Docker base image. Painful. “AOT compiled on 22.04 works fine on the dev laptop” is a sentence I hear before someone discovers their production RHEL 8 nodes are five glibc versions behind.

'The binary that loaded yesterday fails today. No code changed. Only the OS underneath did.'

— Lead engineer, fintech deployment post-Kernel Live Patch

The Cost of Monitoring CRT Dependencies Across Releases

What usually breaks first is not the CRT itself but the Visual C++ redistributable version that your AOT binary indirectly requires. .NET Native AOT still pulls in vcruntime140.dll and vcruntime140_1.dll for certain runtime helpers — exception handling, stack walking on x64. When Windows Update rolls out a new redistributable, it may remove an older version that your binary expected. The seam blows out: you see The procedure entry point ??2@YAPEAX_K@Z could not be located in the dynamic link library vcruntime140.dll. A customer on Windows 10 20H2 gets a black screen; your colleague on 22H2 never reproduces it.

You lose a day per incident. Honestly — I tracked it across three units: between reproducing, identifying the exact CRT API, and either backporting or telling customers to install a specific redistributable, each regression cost 6–8 engineering hours. Monitoring CRT dependencies means shipping with a manifest that lists every PE import, then testing against at least two major Windows release versions plus the latest Insider Preview. Most teams skip this. They add a dotnet publish -p:IncludeNativeLibrariesForSelfExtract=true and assume it's done.

Not every development checklist earns its ink.

Policy memos, stakeholder maps, budget riders, sunset clauses, and public comment windows reshape what looks optional.

Fjords kelp basalt look wild.

Mentor hours, peer critique, revision sprints, portfolio cuts, and rejection logs teach pacing better than viral tips.

Fjords kelp basalt look wild.

That assumption returns as a P1 ticket six weeks later. Native AOT doesn't eliminate the CRT — it just stops bundling it. You trade “ship the CRT with the app” for “trust the OS to provide a compatible CRT forever.” That trust breaks on Patch Tuesday. The fix: pin a known-good Windows container image, test against it pre-deployment, and accept that your “static” binary is only as stable as the version of ucrtbase.dll on the target unit.

When Not to Use Native AOT Because of CRT Hell

Targeting Windows 7 or Server 2008 R2 without recent UCRT

Native AOT on .NET assumes a modern Universal C Runtime (UCRT) — specifically the one shipped with Windows 10 or via KB2999226 on older systems. If your deployment target is Windows 7 SP1 or Server 2008 R2 without that update applied, your shiny solo-file binary will crash on load with a missing `ucrtbase.dll` entry point. The error is cryptic — something like "The procedure entry point ucrtbase_initialize could not be located." I have triaged exactly this scenario for a group shipping a diagnostics tool to oil-rig terminals locked to Windows 7 Enterprise; they had no patch management pipeline. The catch? You can't bundle UCRT into your Native AOT output. It's an OS component, not a redistributable you statically link. So your options narrow: either enforce the KB as a prerequisite (which operations teams will fight), or fall back to ReadyToRun (crossgen) images that coexist with the legacy CRT. That hurts — you lose the startup perf and binary size wins — but a crashing binary is worse. For locked-down industrial environments still on Server 2008 R2, skip Native AOT entirely. Use a trimmed self-contained publish with framework-dependent CRT bridging; it loads even when UCRT is missing, because Windows falls back to the older msvcrt.dll.

Deploying to embedded systems with custom stripped OS images

Embedded Linux? Different CRT, same pain. Custom Yocto builds or stripped Alpine containers often remove parts of musl or glibc that Native AOT expects. The loader expects `__libc_start_main` and a specific `sigaction` registration — missing them means immediate SIGILL or a silent exit. We fixed this once by switching from Native AOT to a Mono AOT compilation for a Raspberry Pi industrial controller; Mono let us link against the exact musl version present on the target. The trade-off: Mono's AOT is less performant than Native AOT, but it doesn't depend on a full glibc setup. Another pitfall: Windows IoT Core with custom image stripping removes `api-ms-win-crt-*` DLLs. Your binary compiles fine on a dev equipment, then fails on the field unit. Most teams skip this: they test only on full Windows images. Don't assume your embedded OS matches desktop Windows. Validate by testing the exact stripped image. If you can't control the OS image — if it's field-updated irregularly — avoid Native AOT. Use a framework-dependent publish with CRT fallback. It's not as fast, but it boots.

When your app uses P/Invoke or native libraries that pull in extra CRT versions

Native AOT handles P/Invoke — it maps managed calls to native exports. But the native libraries you call bring their own CRT baggage. A common pattern: your app marshals data through a third-party C++ DLL compiled against VS 2017's CRT (vcruntime140.dll). Your Native AOT binary links against UCRT only. Now you have two CRT runtimes in the same method — one for your managed code, one for the native DLL. That works fine until memory allocation crosses the boundary — a native `malloc` paired with a managed `free` on the wrong heap. Crash. Worse: the native DLL might dynamically load yet another CRT (via a static link inside itself). I have seen teams revert to framework-dependent publish after discovering that their video-codec wrapper pulled in both MSVCRT and UCRT. The fix pattern: bundle the exact CRT redistributables your native dependencies require. But Native AOT's deployment model — a solo binary with no side-by-side CRTs — fights this. If your P/Invoke chain touches multiple CRT versions, skip Native AOT. Use ReadyToRun with explicit redistributable installers. Or, better, wrap your native calls in a separate approach (IPC) to isolate CRTs — but that introduces latency and complexity. Pick your pain.

Native AOT's CRT assumption is simple: one OS-provided UCRT for everyone. Reality is a pile of legacy DLLs that don't agree.

— paraphrase from a production engineer after a 12-hour debugging session

So when do you walk away from Native AOT? When the target OS is more than ten years old without patches. When the embedded image is a stripped derivative you can't amend. When your native interop layer drags in a museum of CRT versions. Those teams should stay with framework-dependent or Mono AOT — less sleek, but actually bootable.

Open Questions and Quick Answers on CRT Load Failures

How do I check which CRT my binary expects? (Dependency Walker, ldd, dumpbin)

The fastest way to stop guessing is to ask the binary itself. On Windows, dumpbin /imports yourapp.exe spills every DLL your AOT artifact thinks it needs. Scroll for MSVCR*.dll, VCRUNTIME*.dll, or api-ms-win-crt-*.dll. That list *is* your dependency bill. Dependency Walker (depends.exe) is older but still works—though it sometimes lies about delay-load dependencies, so cross-check with dumpbin. On Linux, ldd yourapp gives you the runtime linker's view, but be careful: ldd actually runs the binary (or tries to), so on a broken device it might print "not a dynamic executable" and stop—that's your first clue the file is legitimately static or the ELF header is mangled. For macOS, otool -L does the same job.

The tricky bit is that Native AOT, despite its name, doesn't always strip every CRT reference. I've seen binaries that dumpbin reported as clean yet still crashed with 0xc000007b on a fresh Windows Server Core image. We eventually found a stray import of ucrtbase.dll deep in a transitive dependency—one of our NuGet packages pulled in a native shim that didn't get linked statically. Moral: check not just your exe but every native DLL it loads at runtime. Use approach Monitor (procmon) with a filter on approach Name = yourapp.exe and Path contains .dll. That shows you exactly which CRT files the OS tried to locate before the load failed.

What's the difference between MSVCRT, UCRT, and vcruntime?

Wrong order here causes a lot of pain. MSVCRT (the old Visual C++ runtime, shipped with VS 2005–2013) is the dinosaur. UCRT (Universal CRT) is the Windows OS component—it's part of the stack since Windows 10 and Server 2016, and it gets serviced via Windows Update. vcruntime is the smaller shim that sits on top of UCRT, providing C++-specific stuff like exception handling and new/delete. Native AOT binaries compiled with .NET 8+ typically target UCRT + vcruntime, not the old MSVCRT. That's progress—until you deploy to Windows 7 or Server 2012 R2, which lack UCRT entirely.

What usually breaks first is the version dance. UCRT ships as ucrtbase.dll in C:\Windows\System32 on modern systems, but old machines need the KB update or the VC++ redistributable. The catch is that vcruntime140.dll gets installed by the same redist, and if your AOT binary was linked against vcruntime140_1.dll (for VS 2022 toolchain), the older redist doesn't include it. You get an entry-point-not-found crash that looks like a CRT problem but is actually a mismatched vcruntime version. We fixed this once by pinning the build to the VS 2019 toolchain, which emits vcruntime140.dll—a file more likely to be present on locked-down enterprise images.

“The CRT isn't one thing—it's a stack of three layers, and your binary only needs two of them. Finding which one is missing is half the diagnosis.”

— paraphrased from a debugging session with a staff stuck on 0xc000007b for two days

Can I bundle CRT DLLs alongside my exe without installing?

Yes—but with a sharp edge. You can copy ucrtbase.dll, vcruntime140.dll, and msvcp140.dll into the same folder as your AOT binary. The OS loader finds them there before searching setup paths, as long as your binary doesn't use a side-by-side manifest that forces a specific assembly version. That works fine for a portable USB tool or an internal utility. However—and this is the pitfall—UCRT is a Windows component that expects to be in System32 for servicing reasons. If you bundle it and Windows Update later ships a security patch for UCRT, your bundled copy stays stale. I've seen a CI pipeline that shipped the same CRT DLLs for eighteen months, and when the staff finally ran the app on a fully patched Windows 11 device, the older ucrtbase.dll didn't handle a new internal API call used by the OS—crashes on file I/O that worked fine on the dev machines.

The cleaner approach is to use the vc_redist. installer as a pre-requisite, or deploy via a package manager that handles CRT updates. But if you absolutely can't install anything (locked-down banking terminals, air-gapped factory floor PCs), bundle the DLLs and set LOAD_LIBRARY_SEARCH_DLL_LOAD_DIR via a manifest to prevent the setup from loading its own (possibly incompatible) version. That's fragile—honestly, it's a bandage—but it works until the next OS cumulative update.

Why does 0xc000007b usually mean a 32/64-bit mismatch?

That STATUS_INVALID_IMAGE_FORMAT code almost always signals that a 64-bit process tried to load a 32-bit DLL, or vice versa. Your Native AOT binary is 64-bit? The CRT DLL it finds must also be 64-bit. The error pops up because ucrtbase.dll exists in both C:\Windows\System32 (64-bit) and C:\Windows\SysWOW64 (32-bit). When the wrong one gets loaded—usually because a dependency search path picks the SysWOW64 copy first—the entry point addresses don't align and the loader throws 0xc000007b. We debugged one where a team's installer accidentally deployed a 32-bit VCRUNTIME140.dll into the app folder, and the 64-bit AOT binary loaded it before the system one—instant crash. Fixed by deleting the stray DLL.

Diagnose it fast: open the binary in a hex editor and check the PE header's Machine field (8664 is x64, 14c is x86). Do the same for every CRT DLL in the app folder. If any mismatch, that's your culprit. The tricky variant is when the exe is 64-bit but a native dependency (like a C++/CLI wrapper or a P/Invoke library) pulls in a 32-bit CRT. That doesn't show in your exe's importer list at all—you need Procmon or Dependency Walker to see the chain. A single bad link in the DAG, and the whole load fails.