A shared library is a compiled binary file that another program loads at runtime to gain functionality. On different systems it may appear as a .dll, .so, or .dylib. Unlike source code, a shared library is not meant to be read or executed directly by a person; it is loaded by an application, interpreter, or plugin system when needed. Python extension modules, browser plugins, and many system components use this model.
In cyber security, shared libraries matter because they can carry executable logic while blending into normal software workflows. Attackers may abuse them by replacing a legitimate library, planting a malicious module in a search path, or packaging harmful code inside a file that looks like routine build output. Defenders watch for unusual load locations, unexpected native code in repositories, missing signatures, and unsigned or modified binaries. When a program loads a shared library, that moment becomes an execution point, so verifying what is loaded is a key control against malware and supply-chain tampering.