| Previous | Next |
| STATUS_USER2USER_REQUIRED | STATUS_NO_S4U_PROT_SUPPORT |
STATUS_STACK_BUFFER_OVERRUN
This code is the general user-mode fast-fail exception
The historical name refers to stack-cookie protection, and /GS failures can produce this status. Modern Windows also uses 0xC0000409 for the broader __fastfail mechanism. The first exception parameter carries a FAST_FAIL reason code, so the status alone does not prove that a stack buffer was overwritten.
Fast fail is designed for process states that may already be corrupted. It is a second-chance noncontinuable exception and minimizes in-process work before termination. Capture the parameter list, faulting instruction, and compiler/runtime diagnostics. Attempting to intercept the event and continue can execute with damaged control data. For /GS failures, inspect the protected function and earlier writes, not only the cookie-check routine that detected the mismatch.
What to inspect
- Decode the first exception parameter as the specific FAST_FAIL reason.
- Check whether the instruction is __fastfail, a security-cookie check, or runtime code.
- Inspect earlier memory writes to the affected frame or control structure.
- Do not infer a stack overwrite when the fast-fail reason identifies another invariant.
References
- Microsoft Learn: __fastfail
- Microsoft Learn: /GS buffer security check
- Microsoft Learn: EXCEPTION_RECORD
- Microsoft Learn: Specific Exceptions
Looking for a different code? Search another status or error code.