0x0000001e: Fast Triage and Fixes for BSOD Errors

0x0000001E is the KMODE_EXCEPTION_NOT_HANDLED bug check with value 0x0000001E, and it indicates that a kernel-mode program generated an exception that the error handler didn’t catch, according to Microsoft Learn. A practical starting point is to match the crash timing to the right branch: if crashes are random or happen before you can do much, test memory first; if the crash began right after one driver, app, or update, roll that change back first; if Windows keeps reporting corruption, repair the OS after you have protected your dump files.

This guide is part of our Windows BSOD stop codes: full list and fixes series.

First-response decision tree

• Crashes at startup, sign-in, or while sitting idle: first test is mdsched.exe; second test is to remove any recently added RAM or hardware and retest; escalate if mixed stop codes continue after the memory test and a reseat check.
• Crashes when launching an app, game, VPN, antivirus, or virtual machine: first test is to boot into Safe Mode; second test is Device Manager rollback or uninstall of the most recently changed device driver; escalate if the same crash repeats across multiple apps after rollback and a clean boot. If you need the exact path, use our Safe Mode in Windows 11 guide and then follow a driver rollback in Device Manager walkthrough.
• Crashes that started right after Windows Update or a vendor package: first test is Settings > Windows Update > Update history to match the install date to the first failure; second test is Uninstall updates or device rollback; escalate if rollback is unavailable or the system still crashes in Safe Mode.

What 0x0000001E means and what to note before you change anything

This stop code is a triage problem first. Before uninstalling apps or running repair commands, record the four bug check parameters, the exact moment the crash happens, and any change made in the last day or two. Microsoft’s debugger documentation says that to interpret this bug check, you must identify which exception was generated.

What to record first

Write down the full stop line from the blue screen if it stays up long enough. The parameters matter because they can vary, and Microsoft says the first step is to identify which exception was generated.

• Parameter 1: the exception code. Common examples include 0xC0000005 for an access violation, 0x80000003 for a breakpoint, and 0x80000002 for datatype misalignment, as documented by Microsoft for this bug check family.
• Parameter 2: the address where the exception happened.
• Parameter 3 and 4: extra context. For 0xC0000005, Microsoft documents that Parameter 4 is the address that the driver attempted to access.

Also note when it crashes: at startup, right after sign-in, when opening a game or app, or right after Windows Update or a driver install.

Where to pull evidence in Windows 11

1. Open Reliability Monitor: press Windows + R, type perfmon /rel, press Enter. Check the day the crashes began.
2. Open Event Viewer: press Windows + X > Event Viewer > Windows Logs > System. Look for Critical and Error entries at the same timestamp.
3. Check minidumps: open File Explorer and inspect C:\Windows\Minidump. Match file timestamps to each crash, and copy those dump files somewhere else before changing drivers.

For a quicker timeline, compare Reliability Monitor with the exact crash timestamp in Event Viewer for BSOD troubleshooting. If startup failures keep looping, jump to a Safe Mode in Windows 11 guide first so you can collect logs without another normal-boot crash.

What the minidump usually shows in real 0x0000001e cases

The dump may point in one of a few useful directions: a recent third-party driver near the faulting stack, an access-violation pattern that fits memory instability, or a crash path tied to storage, network, graphics, or security software loaded just before the stop. If the same non-Microsoft driver keeps appearing across multiple dumps, rollback is a reasonable next step. If the implicated module changes from crash to crash and the first parameter is an access violation, memory or broader stability checks are reasonable.

For an additional consumer-oriented walkthrough, see How to fix error code 0x0000001e in Windows 11? (source).

First-response triage table for 0x0000001E

How to use the parameters without deep debugger work

Use the parameters to choose a branch, not to assume they always name the exact culprit. A 0xC0000005 first parameter means a memory access violation occurred, which can fit either a buggy driver or unstable memory. If the same app or action triggers the crash every time, start with the driver branch. If crashes look random, start with the memory branch. That matches Microsoft’s guidance to identify the exception and inspect the faulting context.

Likely causes of 0x0000001E, ranked by how often they show up

Common troubleshooting branches include recent drivers, RAM or wider hardware instability, damaged Windows files or component-store issues, and disk or file-system trouble. Microsoft’s bug-check documentation points to the exception context and any implicated driver, while Windows repair tools such as SFC, DISM, update removal, and Safe Mode cover the other standard branches. For a plain-language overview, see neosmart.net.

1. Recently changed or incompatible drivers

Take this branch first when the blue screen starts after an update, app install, or a new peripheral. GPU, storage or NVMe, chipset, network, antivirus filter drivers, VPN clients, and virtualisation tools are all reasonable places to check because they run close to the kernel.

2. Bad RAM or unstable hardware

Take this branch early if crashes happen during startup, at idle, or under light load with no single app pattern. Random restarts, mixed stop codes, aging systems, or a recent RAM upgrade all make memory and hardware checks reasonable.

3. Corrupted Windows files or component store damage

Take this branch when Windows repairs fail, updates break repeatedly, or SFC keeps finding files after every reboot.

4. Disk or file-system errors

This matters when file access is involved or when the machine also shows file errors, storage warnings, failed updates, or repeated disk events.

Did a driver or update trigger 0x0000001E?

If the blue screen began after Windows Update, a vendor driver package, a game launcher, VPN client, RGB utility, or antivirus install, the safest first move is rollback or removal of the newest driver. Microsoft says that if a driver is identified in the bug check message, disable the driver or check with the manufacturer for driver updates.

Fix steps: Safe Mode, rollback, and update history

1. Boot to Safe Mode. In Windows 11: Settings > System > Recovery > Advanced startup > Restart now. Then go to Troubleshoot > Advanced options > Startup Settings > Restart > press 4.
2. Open Device Manager: Windows + X > Device Manager. Expand Display adapters, Storage controllers, System devices, and Network adapters. Open the suspect device > Properties > Driver > Roll Back Driver if available.
3. If rollback is unavailable, choose Uninstall device, restart, and let Windows load the prior working driver or a basic fallback.
4. Check recent updates: Settings > Windows Update > Update history. If the timing matches, open Settings > Windows Update > Update history > Uninstall updates and remove the newest item.
5. If a specific app triggers the crash, open Settings > Apps > Installed apps, find that app and any closely related low-level utility installed at the same time, uninstall the utility first, restart, and then test the same action again. Common examples include VPN clients, antivirus suites, RGB tools, capture software, and virtualisation packages.

When deciding whether to roll back a GPU, storage, or network driver, confirm the install date, whether Safe Mode stays stable, and whether the same app reproduces the crash. If you want screenshots and the exact button sequence, use this driver rollback in Device Manager walkthrough.

Can bad RAM or unstable hardware cause 0x0000001E?

Yes. If the system crashes before a specific app opens, shows mixed stop codes, restarts while idle, or began after a RAM upgrade, test memory before deeper Windows repairs. Microsoft’s documentation makes memory access violations an important clue, so this branch is especially relevant when the first parameter is 0xC0000005.

Fix steps: memory test and hardware sanity checks

1. Run Windows Memory Diagnostic: press Windows + R, type mdsched.exe, press Enter, then choose Restart now and check for problems.
2. If RAM was added recently, shut the PC down fully, disconnect power, and if it is a laptop with a removable battery follow the device manual before opening it. Reseat the recently added memory, then start the system and retest. If the machine has more than one memory stick and the design allows removal, test with one stick installed at a time to check whether one module or slot is tied to the crashes.
3. Remove recent hardware changes such as a new SSD, dock, USB device, or external adapter, then retest.
4. If the laptop runs very hot or crashes under light load, place it on a hard, flat surface so vents are not blocked, clear visible dust from the vents with the system powered off, and then retest. If the crashes stop only after improving airflow, continue with vendor cleaning or service guidance for the cooling system.

If memory tests fail, or the system still throws mixed stop codes after reseating RAM and removing recent hardware changes, move to hardware replacement or vendor service. If you need a fuller walkthrough, this Windows Memory Diagnostic guide pairs well with the branch above.

Should you run SFC or DISM first for 0x0000001E?

Run sfc /scannow first. It is the quicker and less invasive file repair step for Windows 11. Use DISM /Online /Cleanup-Image /RestoreHealth only if SFC cannot repair files or if corruption keeps returning after restart.

Fix steps: Windows file and image repair

1. Open an elevated Command Prompt: press Windows, type cmd, then choose Run as administrator.
2. Run sfc /scannow.
3. Restart Windows after SFC completes, then test the same action that caused the crash. If SFC reports “Windows Resource Protection found corrupt files and successfully repaired them,” stop there and retest before moving on.
4. If SFC says it found corrupt files but could not fix some of them, or if the same corruption comes back after reboot, reopen elevated Command Prompt and run DISM /Online /Cleanup-Image /RestoreHealth.
5. Restart again and retest before making any other change.

Could disk errors, antivirus, or firmware be behind the crash?

Yes, but this branch usually comes after drivers and RAM unless file errors or storage symptoms showed up first. Run CHKDSK when the system freezes during file access, remove third-party security or VPN software in Safe Mode when the timeline matches, and use a clean boot to isolate non-Microsoft services.

Fix steps: storage, filter drivers, and later-stage checks

1. Open elevated Command Prompt and run chkdsk C: /f /r. If Windows asks to schedule it for the next restart, type Y, restart, let the scan finish, and then check for disk entries in Event Viewer.
2. If a third-party antivirus or VPN was installed just before the crashes, boot into Safe Mode and uninstall it from Settings > Apps > Installed apps.
3. Use msconfig for a clean boot: press Windows + R, type msconfig, press Enter > Services tab > check Hide all Microsoft services > Disable all. Restart and retest.

If CHKDSK reports fixes or Event Viewer shows disk resets, treat storage as a serious branch and review the logs in Event Viewer for BSOD troubleshooting before making additional changes.

Still getting 0x0000001E? When to restore, reset, or reinstall

Use System Restore when the crash began after a recent driver, update, or app change and Safe Mode still works. Use Reset this PC with Keep my files when repairs do not hold. Move to a clean reinstall or hardware service once the same stop code survives branch testing.

If that didn’t work, try this next

1. Open System Restore: press Windows + R, type rstrui, press Enter, and choose a restore point from before the first crash. Personal files stay in place.
2. If restore points are unavailable or the issue returns, go to Settings > System > Recovery > Reset PC, choose Keep my files, follow the prompts, and reinstall apps afterward as needed.
3. Choose a full clean reinstall when the main branches have been tested: driver rollback completed, memory checks done, and SFC or DISM plus CHKDSK did not hold.
4. Choose hardware service instead of reinstall when memory tests fail, crashes happen inside Safe Mode, or the machine throws several different stop codes after a clean Windows setup.

Prevention

When the system is stable again, pause large driver changes. Install one driver or firmware update at a time, reboot, and confirm stability before adding the next. Keeping a quick note of the exact driver version and install date also makes future rollback easier.

Frequently asked questions

How do I fix stop code 0x0000001e on Windows 11?

Start with the branch that matches the timing. For startup or random crashes, run mdsched.exe. For crashes after an update or app install, boot to Settings > System > Recovery > Advanced startup and roll back the newest driver in Device Manager. If file repair signs pile up, run sfc /scannow first. If you need the companion basics, see our Windows 11 BSOD troubleshooting guide.

Which drivers commonly trigger 0x0000001e?

Common places to check are GPU, storage or NVMe, chipset, and network drivers, plus antivirus filter drivers, VPN clients, RGB utilities, and virtualisation tools. Check Device Manager first, then match the install date against Settings > Windows Update > Update history and your minidump timestamps.

Can antivirus software cause a 0x0000001e blue screen?

Yes, especially when the crash begins right after installing or updating a third-party security suite. Antivirus products use low-level filter drivers, so remove them in Safe Mode through Settings > Apps > Installed apps, then restart normally and retest before replacing other drivers.

How do I check whether a recent update caused the crash?

Open Settings > Windows Update > Update history and compare the install date with the first crash in Reliability Monitor by running perfmon /rel. If they line up, use Uninstall updates or a device rollback in Device Manager before running broader repairs.

When should I reinstall Windows after 0x0000001e?

Reinstall after the main branches have failed in order: driver rollback or removal, memory testing with mdsched.exe, and Windows repair with sfc /scannow, DISM /Online /Cleanup-Image /RestoreHealth, and chkdsk C: /f /r. Skip straight to hardware service instead if Safe Mode also crashes or memory tests fail.

Why does 0x0000001e keep happening on an ASUS laptop, or when Windows won’t stay up long enough to troubleshoot?

On laptops, repeated crashes can relate to RAM instability, heat, or a recent OEM driver update. If Windows will not stay up, enter Advanced startup, boot Safe Mode, remove the newest ASUS or device driver, then run mdsched.exe. If crashes continue in Safe Mode, treat it as a hardware case.

Sources

• Microsoft Learn — bug check 0x1E reference and parameter guidance.
• Microsoft Support — Windows startup settings and Safe Mode in Windows.
• Microsoft Support — Using System File Checker in Windows.
• Microsoft Learn — DISM command-line options and image repair guidance.
• Microsoft Support — Windows Update history, uninstall updates, and recovery options.
• neosmart.net — supplemental plain-language overview.
• source — supplemental consumer guide cited above.
• first crash — existing related link retained as provided.