| Previous | Next |
| STATUS_INTEGER_OVERFLOW | STATUS_TOO_MANY_PAGING_FILES |
STATUS_PRIVILEGED_INSTRUCTION
The current privilege level cannot execute this instruction
Processors reserve instructions that alter system state, interrupt handling, control registers, or similar privileged facilities for kernel or hypervisor code. Executing one from ordinary user mode raises this exception. The fault can be intentional in an emulator or probe, but it more often indicates incorrect inline assembly, execution of kernel-targeted code in user mode, or a corrupted branch into arbitrary bytes.
Moving the same instruction into a helper process does not grant privilege. A legitimate operation must use a supported system call, driver, or virtualization interface. If the instruction pointer is not in code that was expected to contain privileged assembly, treat the event as possible control-flow or code corruption and inspect the surrounding bytes and call chain.
What to inspect
- Decode the faulting instruction and verify its required privilege level.
- Confirm whether the module was built for user mode or kernel mode.
- Replace direct hardware access with a documented OS or driver interface.
- Investigate the branch target if the application never intentionally emits that opcode.
References
- Microsoft Learn: EXCEPTION_RECORD
- Microsoft Learn: Exception Dispatching
- Microsoft Learn: Specific Exceptions
- Microsoft Windows SDK metadata: ntstatus.h
Looking for a different code? Search another status or error code.