| Previous | Next |
| RECURSIVE_MACHINE_CHECK | DIRTY_NOWRITE_PAGES_CONGESTION |
ATTEMPTED_EXECUTE_OF_NOEXECUTE_MEMORY
NX/DEP execute-permission violation for ATTEMPTED_EXECUTE_OF_NOEXECUTE_MEMORY
ATTEMPTED_EXECUTE_OF_NOEXECUTE_MEMORY is bug check code 0x000000FC.
This bug check means control flow reached a virtual address that the memory manager does not allow to execute. Typical causes include corrupted function pointers, use-after-free, code injection attempts, bad driver trampolines, or memory marked with the wrong permissions.
How to read it in a dump
- Decode the faulting instruction pointer and PTE or VAD state if available.
- The stack may be corrupted because control flow has already gone through bad memory.
- This is stronger evidence than a generic access violation because execute permission specifically failed.
What to check
- Use WinDbg to inspect the faulting address, pool tag, call stack, and loaded module list.
- Enable Driver Verifier, Special Pool, and code-integrity checks for suspect drivers.
- Review any driver that writes executable stubs, hooks functions, or misuses MDLs and page protections.
References
Looking for a different code? Search another status or error code.