Windows 11 includes a hidden component from Windows 95 to keep older software running without crashing due to memory bugs.
Key points
- Windows 11 ships with EmulateHeap, a compatibility layer based on Windows 95 code.
- This feature was originally created to support the game SimCity on Windows 95.
- The system redirects memory calls to mimic the older, less strict memory manager.
Windows 11 continues to include a functional piece of the Windows 95 kernel for compatibility reasons. This hidden component, known as EmulateHeap, provides older applications with the forgiving memory management they expect.
What happened
Windows 11 version 26H2 includes a working piece of the Windows 95 kernel, according to a report by Windows Latest. A compatibility fix called EmulateHeap gives old applications access to the Windows 95 memory manager when they depend on its specific behavior. This tradition traces back to the game SimCity, which only ran on Windows 95 because Microsoft wrote special code for it. The original SimCity for Windows 3.x contained a use-after-free bug, where the game read memory after it had been freed.
Joel Spolsky, a former Microsoft engineer, shared the story in a 2000 essay, citing Jon Ross, who wrote that version of SimCity. Ross admitted he left a bug where the game read freed memory, but it worked on Windows 3.x because the memory never went anywhere. SimCity broke on Windows 95 betas, so Microsoft added code to Windows 95 that looks for SimCity. If it finds the game running, it runs the memory allocator in a special mode that does not free memory right away. Microsoft modified its operating system just to cover up one game’s bug.
Why it matters
Legacy compatibility layers allow modern systems to run older software that relies on outdated assumptions about how the operating system behaves. In this case, the system mimics the memory management quirks of Windows 95 to prevent crashes. These layers intercept standard memory calls and redirect them to older routines that do not strictly enforce memory safety. This approach prioritizes application stability over modern security standards, as the older memory manager does not immediately clear freed memory.
Understanding these mechanisms helps explain why modern systems retain code from decades past. It highlights the trade-off between supporting legacy software and maintaining strict, secure memory management practices. Teams usually evaluate these compatibility features to ensure they do not introduce unexpected vulnerabilities or performance issues in current environments.
The fix
- Verify which applications on your system are using compatibility modes or legacy heap emulators.
- Review application logs for errors related to memory allocation or heap corruption.
- Test critical applications to ensure they function correctly without legacy compatibility layers.
- Monitor vendor announcements for updates that remove or improve legacy compatibility features.
Why it matters
Legacy compatibility layers allow modern systems to run older software that relies on outdated assumptions about how the operating system behaves. In this case, the system mimics the memory management quirks of Windows 95 to prevent crashes. These layers intercept standard memory calls and redirect them to older routines that do not strictly enforce memory safety. This approach prioritizes application stability over modern security standards, as the older memory manager does not immediately clear freed memory.
Understanding these mechanisms helps explain why modern systems retain code from decades past. It highlights the trade-off between supporting legacy software and maintaining strict, secure memory management practices. Teams usually evaluate these compatibility features to ensure they do not introduce unexpected vulnerabilities or performance issues in current environments.
What to do and how to stay safe: Windows 11
- Identify applications that run in compatibility mode and assess their security requirements.
- Check system documentation for details on how legacy memory managers are implemented.
- Monitor for updates that address compatibility features and improve memory safety.
- Ensure your security tools can detect anomalies in legacy memory allocation patterns.
Step-by-step guide: What is password policies and how they protect systems
General security guidance from the Crypt Weekly newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Why does Windows 11 still have Windows 95 code?
It includes EmulateHeap to support older applications that depend on the specific memory management behavior of Windows 95.
What is EmulateHeap?
EmulateHeap is a compatibility fix that redirects an application’s memory calls to replacements that mimic the Windows 95 heap manager.
How was EmulateHeap built?
Microsoft took a copy of the Windows 95 Heap Manager source code, recompiled it, and added it to the compatibility infrastructure.
