Exception code 0xC0000409, named STATUS_STACK_BUFFER_OVERRUN, is what Windows records when a program deliberately terminates itself after detecting memory corruption or a failed internal safety check. You usually see it in Event Viewer as an Application Error with a faulting module, or as a sudden Chrome or app crash with no message. The fix is to identify which module is faulting, then update, repair, or remove that component.
Key takeaways
- 0xC0000409 is an exception code seen in Event Viewer, not a message you fix by itself. The "faulting module name" beside it is the real clue.
- Despite the name, many cases are not a classic buffer overflow. Modern programs use a fast-fail mechanism that reports this same code when an internal check fails.
- If one program crashes, suspect that program, its add-ons, or a driver it loads. If several unrelated programs crash, suspect RAM, drivers, or system files.
- Run a memory test before you spend hours reinstalling software.
- Repeated crashes combined with freezes or file errors can point to hardware, so back up your data first.
Where you will see this code
Most people never type this code anywhere. It surfaces in three ways. In Event Viewer you find an Application Error entry (Event ID 1000) listing the program name, a faulting module, and "Exception code: 0xc0000409". In Reliability Monitor you see a red cross labelled "Stopped working" for an app. And in Chrome you may get an "Aw, Snap!" page or a tab that vanishes, with the underlying crash recorded the same way. Some games and launchers also show their own short message and quit.
To see it yourself, press Windows + R, type eventvwr.msc, open Windows Logs, then Application, and look for entries from the time of the crash. Under the General tab, note the "Faulting application name" and "Faulting module name". Write them down, because everything below depends on them.
What the name really means
The label says "stack buffer overrun", which suggests a program wrote past the end of a block of memory. That is one cause. But Windows also uses this exact code as the standard report when a program calls its fast-fail routine, which means "something is badly wrong, stop immediately and do not continue". Compilers add these checks to catch memory damage before an attacker or a bug can exploit it. So 0xC0000409 means the safety net triggered, not necessarily that your PC is infected or that one specific thing is broken.
That matters for troubleshooting. The program found corrupted state and chose to close. The corruption can come from the program's own bug, from an add-on loaded into it, from a driver that hooks into it, or from unstable memory. Your job is to find which of those fits.
| Likely cause | How to recognise it | Go to |
|---|---|---|
| Bug in one app or a bad update of it | Only one program crashes, started after its last update | Fix 1 and Fix 2 |
| Browser extension or injected add-on | Chrome or Edge only, tabs die on certain sites | Chrome section below |
| Graphics driver or overlay | Crashes in games, video, or when GPU acceleration is used | Fix 4 |
| Damaged system files or runtime libraries | Several apps crash, faulting module is a Windows or runtime DLL | Fix 3 |
| Unstable RAM or overclock | Random crashes in unrelated apps, sometimes blue screens | Fix 5 |
| Security software conflict | Faulting module belongs to an antivirus or monitoring tool | Fix 6 |
Fixes, from most likely to least likely
Fix 1: Read the faulting module and act on it
The module name tells you where to look. If it is the program's own file, the program needs an update or repair. If it is a DLL belonging to a graphics driver, overlay, or security tool, that component is the suspect. If it is a Windows file such as ntdll.dll or KERNELBASE.dll, it usually means the crash was detected there, not caused there, so look at what the program was doing and which add-ons it loaded. Do not delete DLL files by hand and do not download "DLL fixers".
Fix 2: Update or reinstall the crashing program
Install the latest version from the publisher, then restart. If the crash began right after an update, check the publisher's release notes for a known issue. For a clean reinstall, remove the app in Settings, then Apps, then Installed apps, restart, and install a fresh copy. For apps that keep settings in a profile folder, rename the folder instead of deleting it so you can restore it.
Fix 3: Repair Windows system files
Open Windows Terminal or Command Prompt as administrator and run these in order:
DISM /Online /Cleanup-Image /RestoreHealth
sfc /scannowRestart afterward. If DISM reports a source or component error, our pages on 0x800f081f and 0x80073712 explain what to do next. Also install pending Windows updates in Settings, then Windows Update, because runtime fixes arrive that way. If the app complains about missing runtime files, the Microsoft Visual C++ Redistributable packages can be repaired from Settings, Apps, Installed apps.
Fix 4: Update the graphics driver and turn off overlays
Crashes that happen in games, video playback, or Chrome tabs with heavy graphics often involve the GPU driver. Download the current driver from the graphics vendor or from Windows Update. Then disable screen overlays and recording tools (game overlays, FPS counters, capture tools) as a test, since they inject code into other programs. If the crashes stop, re-enable them one at a time to find the culprit.
Not sure what is wrong? Get a diagnosis first.
Our certified tech can connect remotely, check your software, drivers and backups, and tell you honestly whether the problem needs a hands-on repair.
Fix 5: Test your memory
Unstable RAM causes the kind of random, unrelated crashes that make a fast-fail report appear. Press Windows + R, type mdsched.exe, and choose to restart and check. Save your work first: Windows restarts immediately. Windows will test on boot and show the result after sign-in. If you overclocked the CPU or enabled a memory profile such as XMP or EXPO in the BIOS, return to default settings for a day as a test. Errors in the memory test mean the module or the setting needs attention, and further software fixes will not hold.
Fix 6: Check security and monitoring software
If the faulting module belongs to a security product, a VPN client, or a monitoring agent, update it, or temporarily disable the specific feature that hooks into the program, such as web protection or exploit protection for that app. Re-enable it as soon as the test is done. Do not leave a PC without protection. Windows Security stays active when you remove a third-party product, so a test with only the built-in protection is a safe comparison.
Fix 7: Clean boot test
Press Windows + R, type msconfig, open Services, tick "Hide all Microsoft services", and select Disable all. Then disable startup items in Task Manager and restart. If the crash disappears, turn items back on in small groups until it returns. This isolates third-party background software without changing your files. When you are finished, open msconfig, choose Normal startup on the General tab, click Apply, and re-enable the services and startup items you turned off. Disabling all non-Microsoft services also turns off any third-party antivirus, VPN or backup service while you test.
Chrome and Edge: tab crashes with this code
Browsers run each tab in its own process, so a fast-fail inside one tab shows as "Aw, Snap!" while the rest keep working. Start with the cheapest test: open an Incognito or InPrivate window, which loads without most extensions. If the problem vanishes, extensions are involved. Go to chrome://extensions (or edge://extensions), turn all off, and re-enable them one at a time. Next, open Settings, System, and switch off "Use graphics acceleration when available" as a test, then restart the browser. Finally check chrome://crashes for recorded crash reports, and keep the browser updated.
Browser crashes that name other codes have their own page: see Chrome STATUS_BREAKPOINT. If a program refuses to start rather than crashing midway, you are more likely facing 0xc0000142 or 0xc000007b.
0xC0000409 compared with 0xC0000005
These two codes are cousins but not twins. 0xC0000005 is an access violation: the program touched memory it was not allowed to touch. 0xC0000409 is the program stopping itself after noticing damage. If your Event Viewer lists both for the same app, treat the memory and driver steps above as the priority, because both suggest corrupted memory state.
What not to do
- Do not run "registry cleaners" or DLL download tools. They add risk and rarely address a fast-fail.
- Do not assume it is a virus. The code is a safety report. Run a Windows Security scan if you like, but expect another cause.
- Do not reinstall Windows first. Reinstalls cost hours. A memory test and a driver check take minutes.
- Do not disable Windows exploit protection globally. If you test it, do so for one program and re-enable it afterward.
- Do not ignore recurring crashes on a PC with important files. Back up first.
When to call a professional
Get help if the memory test reports errors, if crashes come with blue screens, freezes, disk clicking, or corrupted files, or if the faulting module changes every time. Those are signs of failing hardware, and a failing drive can lose data. If you handle business files on the machine, stop experimenting and copy them to a safe place. Our team can read the Event Viewer entries, run diagnostics, and fix software causes remotely. See remote repair and Windows support. For blue screens that appear alongside the crashes, read fix blue screen on Windows 11.
Prevention
- Keep Windows, graphics drivers, and your browser updated, but wait a few days before taking brand-new driver releases on a critical PC.
- Limit browser extensions to what you actually use, and remove abandoned ones.
- Avoid running several overlay or capture tools together.
- Leave the BIOS memory and CPU settings at stable defaults on a work machine.
- Open Reliability Monitor now and then (type
perfmon /relin Run) to spot a repeating crash early. - Keep a recent backup, so a crash trend is an annoyance rather than a risk.
FAQ
What is exception code 0xC0000409?
It is STATUS_STACK_BUFFER_OVERRUN. Windows uses it when a program stops itself after a failed safety check, including fast-fail reports, which often indicate corrupted memory state.
Does it mean I have a virus?
Not by itself. It is a crash report, and most causes are software bugs, add-ons, drivers, or unstable memory. A normal Windows Security scan is a reasonable precaution but rarely the answer.
Why does Chrome crash with this code?
Common triggers are a faulty extension, graphics acceleration problems, or an outdated driver. Test in Incognito, disable extensions, update the browser, and try turning off graphics acceleration.
Where do I find the code in Event Viewer?
Open eventvwr.msc, go to Windows Logs, Application, and look for Error entries from the crash time with Event ID 1000. The General tab shows the faulting module and the exception code.
Can bad RAM cause it?
Yes. Unstable memory or an aggressive overclock can corrupt data and trigger these checks in unrelated programs. Run the Windows Memory Diagnostic with mdsched.exe.
Do sfc and DISM fix it?
Sometimes, if the faulting file belongs to Windows or a shared runtime. They are safe to run, but they do not fix a bug inside a third-party app.
What is the difference from 0xC0000005?
0xC0000005 is an access violation, a program touching forbidden memory. 0xC0000409 is a self-stop after a failed check. They can appear on the same PC and share causes.
Can you diagnose it remotely?
Yes. A technician can review the logs, test drivers and add-ons, and run system repairs through a remote session.