An unsigned DLL is a dynamic-link library that does not carry a trusted digital signature from a known publisher. In Windows environments, signatures help prove where a file came from and whether it was changed after release. An unsigned DLL is not automatically malicious, but it is harder to trust because there is no strong built-in evidence of origin or integrity.
In cyber security, unsigned DLLs matter because attackers often rely on them to blend into normal software behavior. A hostile library can be dropped into a plugin folder, a searched path, or another writable directory so a legitimate application loads it as if it were expected. Defenders look for unexpected unsigned modules, especially in plugin-heavy tools, and combine that with path controls, allowlisting, and signature verification. Code signing, strict update channels, and monitoring for DLL loads from user-writable locations help reduce this risk.