0x0000001e: Fast Triage and Fixes for BSOD Errors
0x0000001E is the KMODE_EXCEPTION_NOT_HANDLED bug check with value 0x0000001E, and it indicates that a kernel-mode program generated an exception that the error handler didn’t catch, according to Microsoft Learn. A practical starting point is to match the crash timing to the right branch: if crashes are random or happen before you can do much, test memory first; if the crash began right after one driver, app, or update, roll that change back first; if Windows keeps reporting corruption, repair the OS after you have protected your dump files.
This guide is part of our Windows BSOD stop codes: full list and fixes series.
First-response decision tree
- Crashes at startup, sign-in, or while sitting idle: first test is mdsched.exe; second test is to remove any recently added RAM or hardware and retest; escalate if mixed stop codes continue after the memory test and a reseat check.
- Crashes when launching an app, game, VPN, antivirus, or virtual machine: first test is to boot into Safe Mode; second test is Device Manager rollback or uninstall of the most recently changed device driver; escalate if the same crash repeats across multiple apps after rollback and a clean boot. If you need the exact path, use our Safe Mode in Windows 11 guide and then follow a driver rollback in Device Manager walkthrough.
- Crashes that started right after Windows Update or a vendor package: first test is Settings > Windows Update > Update history to match the install date to the first failure; second test is Uninstall updates or device rollback; escalate if rollback is unavailable or the system still crashes in Safe Mode.
What 0x0000001E means and what to note before you change anything
This stop code is a triage problem first. Before uninstalling apps or running repair commands, record the four bug check parameters, the exact moment the crash happens, and any change made in the last day or two. Microsoft’s debugger documentation says that to interpret this bug check, you must identify which exception was generated.
What to record first
Write down the full stop line from the blue screen if it stays up long enough. The parameters matter because they can vary, and Microsoft says the first step is to identify which exception was generated.
- Parameter 1: the exception code. Common examples include
0xC0000005for an access violation,0x80000003for a breakpoint, and0x80000002for datatype misalignment, as documented by Microsoft for this bug check family. - Parameter 2: the address where the exception happened.
- Parameter 3 and 4: extra context. For
0xC0000005, Microsoft documents that Parameter 4 is the address that the driver attempted to access.
Also note when it crashes: at startup, right after sign-in, when opening a game or app, or right after Windows Update or a driver install.
Where to pull evidence in Windows 11
- Open Reliability Monitor: press Windows + R, type perfmon /rel, press Enter. Check the day the crashes began.
- Open Event Viewer: press Windows + X > Event Viewer > Windows Logs > System. Look for Critical and Error entries at the same timestamp.
- Check minidumps: open File Explorer and inspect
C:\Windows\Minidump. Match file timestamps to each crash, and copy those dump files somewhere else before changing drivers.
For a quicker timeline, compare Reliability Monitor with the exact crash timestamp in Event Viewer for BSOD troubleshooting. If startup failures keep looping, jump to a Safe Mode in Windows 11 guide first so you can collect logs without another normal-boot crash.
What the minidump usually shows in real 0x0000001e cases
The dump may point in one of a few useful directions: a recent third-party driver near the faulting stack, an access-violation pattern that fits memory instability, or a crash path tied to storage, network, graphics, or security software loaded just before the stop. If the same non-Microsoft driver keeps appearing across multiple dumps, rollback is a reasonable next step. If the implicated module changes from crash to crash and the first parameter is an access violation, memory or broader stability checks are reasonable.
For an additional consumer-oriented walkthrough, see How to fix error code 0x0000001e in Windows 11? (source).
First-response triage table for 0x0000001E
| Crash context | Likely branch | Test first | Log before changing anything | Escalate when |
|---|---|---|---|---|
| At startup, during sign-in, or while idle | RAM or hardware instability | Run mdsched.exe, remove recent hardware, and reseat recently added RAM if applicable | Parameter 1 code, Reliability Monitor date, Event Viewer critical entries, minidump timestamp | Mixed stop codes continue after memory test and reseat checks |
| During app launch, gaming, VPN connect, or when opening security software | Driver conflict | Boot into Safe Mode from Settings > System > Recovery > Advanced startup > Restart now, then Troubleshoot > Advanced options > Startup Settings > Restart > press 4. In Device Manager, check the most recently changed GPU, audio, VPN, antivirus, or virtualisation device, use Properties > Driver > Roll Back Driver if it is available, or choose Uninstall device and restart. | Parameter 2 address, any driver name shown, exact app that triggers the crash, update date | Crash repeats with multiple apps after driver rollback and clean boot |
| Started right after Windows Update or a vendor driver package | Recent update regression | Uninstall the newest update or use Device Manager rollback before deeper repairs | Install date from Update history, minidump timestamp, Parameter 1, device recently changed | Rollback is unavailable or the system still crashes in Safe Mode |
| After file errors, failed updates, or repeated SFC corruption | Windows image or file corruption | Open an elevated Command Prompt, run sfc /scannow, restart, and test the same action again. Only if SFC reports files it could not repair, or the corruption returns after reboot, run DISM /Online /Cleanup-Image /RestoreHealth and restart once more. | SFC result text, DISM result, Event Viewer disk or servicing errors | Corruption returns after reboot or repairs fail repeatedly |
| With freezes, slow boots, file errors, or storage warnings | Disk or file-system trouble | Open an elevated Command Prompt and run chkdsk C: /f /r. If Windows says the volume is in use, answer Y to schedule the check, restart, and then review the result in Event Viewer or on the next boot summary. | Disk-related errors in Event Viewer, CHKDSK output, crash timing during file access | Bad sector signs persist or the system remains unstable after disk repair |
How to use the parameters without deep debugger work
Use the parameters to choose a branch, not to assume they always name the exact culprit. A 0xC0000005 first parameter means a memory access violation occurred, which can fit either a buggy driver or unstable memory. If the same app or action triggers the crash every time, start with the driver branch. If crashes look random, start with the memory branch. That matches Microsoft’s guidance to identify the exception and inspect the faulting context.
Likely causes of 0x0000001E, ranked by how often they show up
Common troubleshooting branches include recent drivers, RAM or wider hardware instability, damaged Windows files or component-store issues, and disk or file-system trouble. Microsoft’s bug-check documentation points to the exception context and any implicated driver, while Windows repair tools such as SFC, DISM, update removal, and Safe Mode cover the other standard branches. For a plain-language overview, see neosmart.net.
