What does Windows error code 1282 (ERROR_STACK_BUFFER_OVERRUN) mean?

ERROR_STACK_BUFFER_OVERRUN

A stack integrity check detected memory corruption.

ERROR_STACK_BUFFER_OVERRUN is Win32 error 1282 (0x502). It reports a stack-based overwrite serious enough to threaten control data such as a return address, exception state, or protected parameter. The process must be treated as compromised even when the visible input looked harmless.

What the detection means

Microsoft’s /GS protection places a security cookie around selected stack objects and verifies that the cookie still has its expected value. A mismatch indicates that memory outside an intended buffer may have been overwritten. The check detects some corruption patterns; it is not proof that every earlier write in the process was valid.

Frequent root causes

• copying untrusted data into a fixed-size local array without a length check
• an off-by-one terminator write after a correctly sized payload
• using byte counts where an API expects characters or elements
• incorrect structure packing or ABI assumptions across module boundaries
• a use-after-return or unrelated write that damages another stack frame

Incident evidence

Preserve a full crash dump, exception or fail-fast record, faulting thread stack, loaded-module list, build identifiers, input sample, and compiler options. Keep the original binary and symbols. Do not depend only on the frame where the cookie check fires, because the corrupting write may have occurred earlier in the function or on another path.

Diagnostic workflow

Reproduce with AddressSanitizer, page heap where relevant, and compiler warnings enabled. Audit every size conversion leading to the affected buffer, including signed-to-unsigned changes and multiplication overflow. Compare declared capacity, requested length, actual encoded length, and terminator requirements. Fuzz the smallest parser or serializer that can reach the fault.

Security review should determine whether external input controls the overwrite and whether the affected build was distributed. Rotate secrets handled by the process if memory disclosure is plausible, and assess whether an attacker could influence control flow. Disabling /GS or catching the termination does not repair the vulnerability.

Recovery

Terminate the corrupted process, fix the bounds error, rebuild with stack protection enabled, and deploy a new version. Add a regression test that exercises the exact boundary and one element beyond it. A service manager may restart the process, but automated restart is only containment and must not be presented as a permanent solution.

Difference from ordinary access violations

An access violation identifies an invalid memory access at a particular instruction. Error 1282 represents detected corruption of protected stack state and can surface after the original write. It therefore requires both debugging and a security-impact assessment.

References

• Microsoft: System Error Codes (1000–1299)
• Microsoft: /GS buffer security check
• Microsoft: AddressSanitizer stack-buffer-overflow example
• Microsoft: Windows Error Reporting

Looking for a different code? Search another status or error code.