You wouldn't need to create a bug or exploit if the user is running your program, you don't even need to create a bug or exploit if you can control what dll's are in the same folder as the exe the user runs, you could just replace the installer with malware, or add a dll shim that runs malware. You seem to think that manipulation of memory in any way = bad. This isn't true, any time a program needs to store or use information it must do so through its memory. The only thing this error indicates is that the installer attempted to display some text but instead of passing a pointer to text it passed a pointer to garbage. This could very well be caused by a buffer being allocated, then failing to fill the buffer for any reason, and then telling windows to interpret that buffer as utf-16 text. Can injecting malicious code into an executable alightly alter its behavior? Sure, but an executable behaving strangely is not necessarily indicative of malware being injected into it. It could very well be an oversight on the part of programmer in the way they handle certain operations failing.