NTSTATUS 0xC0000028 (STATUS_BAD_STACK): meaning and diagnosis

Status / error code:		Category:

Constant name:
Source:		Operating System:
Description: The exception dispatcher found an invalid or misaligned stack during unwind.

Previous	Next
STATUS_UNWIND	STATUS_INVALID_UNWIND_TARGET

STATUS_BAD_STACK

The stack could not be trusted for exception unwinding

Windows validates stack bounds, alignment, and frame progression while dispatching and unwinding exceptions. This status means the current establisher frame or reconstructed stack state did not satisfy those rules. A corrupted return address, stack pointer overwrite, incorrect unwind metadata, or hand-written prolog that violates the ABI can all produce the same result.

The handler where validation stops is not necessarily the code that damaged the stack. Compare the current stack pointer with the TEB limits, inspect preceding frames for impossible sizes, and validate the module’s pdata/xdata. On x64, prologs and epilogs are deliberately restricted so the unwinder can reverse them; generated code must describe equivalent operations accurately.

What to inspect

Check stack pointer alignment and whether it lies between stack limit and stack base.
Validate the current RUNTIME_FUNCTION and unwind-code sequence.
Look for overwritten return addresses and implausible frame transitions.
Review hand-written assembly, hooks, and JIT prologs against the ABI.

References

Looking for a different code? Search another status or error code.