What does NTSTATUS 0xC0000005 (STATUS_ACCESS_VIOLATION) mean?

STATUS_ACCESS_VIOLATION

The processor trapped an invalid memory access

STATUS_ACCESS_VIOLATION (0xC0000005) means code attempted to read, write, or execute an address that was not valid for that access. The failing instruction is where Windows detected the violation; the defect can have happened earlier through a bad pointer, use-after-free, buffer overwrite, race, or corrupted object state.

Evidence that identifies the real fault

• Capture the exception record, faulting instruction address, target memory address, access type, thread stack, and loaded-module versions.
• Preserve a dump from the first occurrence when possible. Repeated crashes after recovery code has run can obscure the original corruption.
• Check whether the address belongs to a freed allocation, guard page, unloaded module, invalid object, or executable-data transition.
• For a reproducible native process, use page heap, Application Verifier, sanitizers, or debugger data to move detection closer to the write or lifetime error that damaged state.

What not to infer

The status does not by itself identify antivirus software, DEP, defective RAM, or a missing DLL. Disabling security controls or adding broad exclusions can hide a symptom without fixing the invalid access. If hardware corruption is suspected, establish that from independent evidence rather than from 0xC0000005 alone.

Recovery boundary

Fix the code or component responsible for the invalid pointer, lifetime, bounds, or executable-memory contract, then reproduce the same operation. If the exception moves to a different status after that correction, diagnose the new result separately.

References

• Microsoft Open Specifications: NTSTATUS values
• Microsoft: Access violation 0xC0000005