We were linking against the release CRT but defining _DEBUG, which should only be defined when using the debug CRT.