Skip to content
PCDecoder
0x000000F7DRIVER_OVERRAN_STACK_BUFFERStop codeWidely reported

DRIVER_OVERRAN_STACK_BUFFER (0xF7): what it means and how to fix it

Updated Nov 8, 2026 · Checked against Microsoft documentation · How this page is made

Quick answer

The DRIVER_OVERRAN_STACK_BUFFER error (bug check 0x000000F7) means a device driver wrote data beyond its reserved memory buffer, threatening system integrity. Windows halts the system intentionally to prevent unauthorized memory modification or exploits. Updating or removing recently added hardware drivers is the first troubleshooting step.

What it means

Windows relies on structured memory areas called stacks to keep track of active functions, local variables, and return addresses. When a driver function runs, it receives a specific amount of stack space to store temporary data. To protect critical data, modern compilers place a small security value—called a security check cookie—on the stack right before the function return address.

Why Windows halted the PC

Stop code 0x000000F7 occurs when a driver overruns a stack-based buffer or local variable. The driver wrote more data into that temporary memory slot than it was allocated to hold. This overflow spilled into neighboring memory, corrupting or overwriting the security cookie and the return address.

In standard execution, overwriting a return address means that when the function finishes, the processor would jump to an arbitrary memory address instead of returning safely to normal system code. Because this mechanism mimics a classic buffer overrun exploit, the Windows kernel deliberately forces a blue screen crash. Shutting down immediately prevents malicious code or a broken driver from hijacking control of the operating system.

Decoding the parameters

When this crash occurs, Windows records four diagnostic parameters. Parameter 1 shows the actual security check cookie found on the stack, which was modified by the overflow. Parameter 2 shows the expected security check cookie, while Parameter 3 shows the bit-complement of that expected cookie. Parameter 4 is reserved as 0. In developer environments, analyzing crash dumps with commands such as kb (Display Stack Backtrace) reveals the exact driver routine responsible for writing past its boundary.

Common causes

  • A device driver overran a stack-based buffer or local variable, corrupting the return address.
  • A newly installed or recently updated device driver contains programming bugs in its memory handling.
  • A newly added hardware device or peripheral is using incompatible driver software.
  • Underlying disk corruption or a virus infection damaged system structures.

How to fix it

Safest and most likely fixes first. Readers' answers to "Did this fix it?" reorder this list over time.

  1. Update or rollback recently added device drivers

    Use this fix first if the crash started appearing after installing new drivers, updates, or peripheral hardware.

    1. Right-click the Start button and select Device Manager.
    2. Check all device categories for any hardware marked with a yellow exclamation point (!).
    3. Right-click the affected device, or any recently updated component such as your graphics adapter or network card, and select Properties.
    4. Select the Driver tab.
    5. Click Update Driver to search automatically for updated software, or click Roll Back Driver if the issue began directly after a driver update.
    6. Restart your PC to apply the changes.
    Did this fix it?

  2. Inspect the System Log in Event Viewer

    Use this fix to pinpoint the exact driver, service, or hardware event that failed immediately before the blue screen.

    1. Right-click the Start button and select Event Viewer.
    2. Expand Windows Logs in the left sidebar and select System.
    3. Filter or scroll through the list to find Critical or Error entries timestamped right before the crash.
    4. Read the event details to identify the specific file name, service, or device hardware associated with the failure.
    5. Uninstall or update the specific driver or software named in the log.
    Did this fix it?

  3. Disconnect newly added hardware

    Use this fix if the blue screen started occurring shortly after plugging in a new external or internal hardware component.

    1. Shut down the computer completely.
    2. Disconnect any recently attached external devices, such as secondary monitors, USB adapters, or external drives.
    3. If you recently installed internal components like a new expansion card, power off the machine, disconnect the power cable, and remove the hardware.
    4. Power the computer back on and observe if the system runs stably.
    5. Visit the hardware manufacturer website to download and install certified patches or drivers before reconnecting the device.
    Did this fix it?

  4. Run a full malware scan

    Use this fix to ensure malicious programs or Master Boot Record infections are not corrupting system files.

    1. Click Start, type Windows Security, and press Enter.
    2. Select Virus & threat protection.
    3. Click Scan options.
    4. Select Full scan to inspect all files and running programs on your hard disks, or run an offline scan to check boot sectors.
    5. Click Scan now and allow the utility to quarantine or remove any detected threats.
    Did this fix it?

Is it just you?

25+ Microsoft Q&A threads discuss this. Most recent activity:

Checked Nov 8, 2026. Refreshed automatically every few days.

Sources

Frequently asked questions

What is DRIVER_OVERRAN_STACK_BUFFER?

It is a Windows blue screen stop code indicating that a kernel driver wrote data beyond its assigned memory limit. The operating system forces a crash to prevent the corrupted return address from executing arbitrary code.

Is 0x000000F7 caused by malware or a virus?

While the crash behavior mimics a buffer overrun attack, the error is usually caused by a bug in a legitimate driver. However, viruses that corrupt disks or the Master Boot Record can also trigger system bug check codes.

How do developers identify which driver caused 0xF7?

Developers load the memory dump into a kernel debugger like WinDbg and run the kb command to display the stack backtrace. The routine listed immediately before the buffer overrun handler indicates which driver overran its variable.

More stop codes decoded