STOP CODE · 0xF7
DRIVER_
A driver wrote more data into a small working area than it could hold. Windows detected it and stopped at once, because that kind of overflow is how attackers take control of a system.
WHAT MICROSOFT SAYS
Microsoft's reference says this bug check "indicates that a driver has overrun a stack-based buffer" in a way that would have overwritten the function's return address, and adds: "This is the classic 'buffer overrun' hacking attack. The system has been brought down to prevent a malicious user from gaining complete control of it."
From Microsoft's documentation, linked under Sources. Microsoft wrote its page for this code for programmers; the steps below are the ones it gives everyone else.
TECHNICAL SUMMARY
| Stop code | DRIVER_OVERRAN_STACK_BUFFER |
|---|---|
| Value | 0x000000F7 (0xF7) |
| Where you see it | At the bottom of the stop screen, and in the System event log after the restart |
| In Tweaky Driver | Stop codes are not read; driver versions are checked |
What causes DRIVER_
- A driver overran a stack-based buffer, or local variable.
- Microsoft notes the same overflow is the classic technique of an attack, which is why Windows stops instead of continuing.
How to fix DRIVER_
The steps come from Microsoft's guidance, with the reversible ones first. Each one says how to put back what it changed. If Windows cannot start normally, Microsoft's basic steps say to start in safe mode and continue from there.
Write down the stop code and the file the screen names
Microsoft Support says the stop code appears at the bottom of the screen and, when Windows knows it, so does the name of the module that was running. If the screen went by too fast, the command under Check it yourself lists the stop codes Windows recorded, and Event Viewer > Windows Logs > System shows the errors logged around the restart.
To undo: Nothing to undo: this only reads information.
Before you change anything: note the driver and make a restore point
Open the device's Properties > Driver tab and write down the driver provider, date and version. Then select Start, type Create a restore point, open it, and on the System Protection tab choose Create. Microsoft notes that System Protection is not turned on by default; if Create is greyed out, choose Configure and turn it on for the system drive first.
To undo: A restore point changes nothing by itself. To go back later, run System Restore and pick it: Microsoft says it reverts system files, the registry and installed programs, and leaves your personal files alone.
Update the driver the screen names
Microsoft's advice when a driver is identified in the bug check message is to disable the driver or check with the manufacturer for driver updates. In Device Manager, right-click the device and choose Update driver, or install the current package from the manufacturer's support page for your exact model. A driver with this fault needs a corrected version from its maker.
To undo: Open the device's Properties > Driver tab and choose Roll Back Driver, or apply the restore point.
If it started after a driver update, roll the driver back
In Device Manager, right-click the device, choose Properties, open the Driver tab and select Roll Back Driver, then give a reason and confirm. Microsoft notes that you need administrator rights, and that going back to the previous driver often fixes a problem that appeared after an update. The button is greyed out when Windows kept no earlier driver for the device.
To undo: Rolling back is the undo for the update. To return to the newer driver, install it again with Update driver or from the manufacturer's package.
Take out what you added just before it started
Microsoft's first basic step for a stop code that keeps coming back is to remove new hardware: shut the PC down, disconnect the device and start again. Its bug check pages say the same about drivers and system services added recently: remove or update them, and work out what changed just before the first crash.
To undo: Reconnect the hardware, or install the program or driver again.
Run a full virus scan
Because Microsoft describes this overflow as the classic attack technique, rule out malicious software: open Windows Security > Virus & threat protection > Scan options and run a Full scan.
To undo: A scan changes nothing by itself; anything it quarantines is listed in Windows Security under Protection history.
Install the latest Windows updates
Select Start > Settings > Windows Update and choose Check for updates. It is one of Microsoft's basic steps for a stop code that keeps returning, and it is how new versions of Windows' own drivers arrive.
To undo: If the crashes get worse after an update, apply the restore point from the earlier step.
If nothing helps, go back to a restore point
Microsoft's last basic step is to restore Windows from a system restore point made before the crashes began, or to use one of its other recovery options.
To undo: System Restore leaves personal files alone; programs and drivers installed after that restore point have to be installed again.
Check it yourself
List the stop codes Windows recorded (PowerShell)
Each entry gives the date, the stop code as a hexadecimal number with its four parameters, and where the dump file was saved. On the test PC, Windows 11 build 26300, this ran without administrator rights. An error saying no events were found means Windows recorded none. This stop code appears there as 0x000000f7.
PowerShellGet-WinEvent -FilterHashtable @{ LogName='System'; Id=1001; ProviderName='Microsoft-Windows-WER-SystemErrorReporting' } -MaxEvents 5 | Format-List TimeCreated, MessageList the driver packages installed on the PC
Shows every third-party driver package with its provider, class, version and date, so you can see what was installed around the first crash. Nothing is changed.
cmdpnputil /enum-drivers
What Tweaky Driver can and cannot do here
Driver version checkTweaky Driver does not read crash dumps or stop codes, so it cannot tell you which driver caused this screen. It helps with the step that comes after Windows names a driver: its scan lists every device with the installed driver version and shows whether Windows Update, the Microsoft Update Catalog or a manufacturer package it supports has a newer one, with the source and version in front of you before anything is installed. It does not scan for malicious software. A newer driver is no promise that the blue screen stops: the same code can come from hardware or from Windows itself.
Tweaky Driver, the driver checker that shows its sources — free for Windows 10 and 11.
Common questions
What does DRIVER_OVERRAN_STACK_BUFFER mean?
A driver overran a stack-based buffer, a small temporary working area, in a way that would have overwritten the address the function returns to.
Does DRIVER_OVERRAN_STACK_BUFFER mean I have a virus?
Not by itself. Microsoft calls the overflow the classic buffer overrun attack and says Windows stops to prevent a malicious user from gaining control; the check fires whenever a driver overruns such a buffer, whatever the reason. A full scan with Windows Security is the way to rule an attack out.
What should I do when it happens in one game or program?
The steps are the same: note the file the screen names, then get a newer version of that driver from its maker, or go back to the previous version if the crashes began after an update.