ATTEMPTED_EXECUTE_OF_NOEXECUTE_MEMORY: NX Bit Conflicts And Real Fixes

Contents show

Introduction

The Windows stop code ATTEMPTED_EXECUTE_OF_NOEXECUTE_MEMORY is a BSOD that appears when code tries to run from memory marked as non-executable. You may see it during boot, when launching a game or driver-heavy app, or randomly under load. It’s critical to fix because repeated BSODs can corrupt data and often point to faulty drivers, bad RAM, firmware bugs, or misconfigured DEP/NX settings.

This guide goes beyond generic advice. You’ll learn what this error means, why the NX bit (No-eXecute) matters, how to analyze minidump files, and a prioritized, step-by-step path to real fixes that work on Windows 10 and Windows 11.

Understanding the Error

The ATTEMPTED_EXECUTE_OF_NOEXECUTE_MEMORY bug check (stop code 0x000000FC, often shown as 0xFC) occurs when the CPU detects an attempt to execute instructions from a page of memory that the OS has marked as non-executable. Modern CPUs support an NX/XD bit (AMD: NX, Intel: XD, ARM: XN) that lets Windows enforce Data Execution Prevention (DEP). If a kernel-mode driver or component jumps into non-executable memory—often due to memory corruption, use-after-free bugs, or malicious hooks—Windows halts with this BSOD to protect the system.

Plainly: a driver or kernel component tried to run code from a memory region that’s supposed to contain only data, not executable code.

Typical scenarios:

A buggy driver executes from freed or corrupted memory.
Overclocking or unstable RAM causes random memory corruption and execution faults.
Firmware or BIOS changes affecting NX/DEP create conflicts.
Security software, anti-cheat, or hypervisor tools inject kernel hooks that trip DEP/NX.
Malware/rootkits attempting to execute in protected regions.
Mismatched or outdated chipset, storage, or GPU drivers.

Key takeaway: The NX fault is usually a symptom of a bad driver or memory corruption, not the root cause. We need to identify and fix the defective component.

Common Causes

Likely triggers for ATTEMPTED_EXECUTE_OF_NOEXECUTE_MEMORY (0xFC):

Driver issues:
- Outdated or buggy drivers (GPU, storage, network, USB, audio)
- Unsigned or test drivers
- Conflicts from anti-cheat, VPN, overlays, security tools
Memory instability:
- Faulty RAM or unstable XMP/EXPO profiles
- CPU/SoC overclocks or undervolts causing memory errors
Storage and file integrity:
- Disk errors, bad sectors, corrupt NTFS
- System file corruption (WinSxS, kernel binaries)
Firmware/BIOS configuration:
- Misconfigured Execute Disable Bit (XD/NX) settings
- Old BIOS/UEFI, outdated SSD firmware
Windows updates and compatibility:
- Recent feature updates or driver updates introducing regressions
Malware:
- Kernel-mode rootkits or malicious drivers
Power/boot settings:
- Fast Startup or hybrid sleep inconsistencies after update/driver changes

Symptoms you might notice:

BSOD during boot or after logging in
BSOD when launching certain apps/games
Random crashes under GPU/IO load
Minidumps referencing random drivers or memory addresses

Preliminary Checks

Before deep-dive diagnostics, do these essentials.

Boot to Safe Mode:
- Hold Shift while selecting Restart -> Troubleshoot -> Advanced options -> Startup Settings -> Restart -> press 4 (Safe Mode) or 5 (Safe Mode with Networking).
- Alternatively: Settings -> System -> Recovery -> Advanced startup -> Restart now.
Back up important data:
- Copy critical files from C:\Users\ to external storage or cloud.
Run basic health checks:
- Open an elevated Command Prompt (Run as administrator) and run:

sfc /scannow

If SFC reports errors it can’t fix:

DISM /Online /Cleanup-Image /RestoreHealth
sfc /scannow

Check disk (system drive usually C:). For online scan:

chkdsk C: /scan

For full fix at next reboot (longer, may lock disk):

chkdsk C: /f /r

These simple repairs often resolve corruption that can trigger NX violations.

Step-by-Step Troubleshooting

Follow these in order, from easiest to most effective.

Confirm DEP/NX status and BIOS setting

In an elevated Command Prompt:

bcdedit /enum {current}

Look for the nx setting. Typical values: OptIn, OptOut, AlwaysOn, AlwaysOff.
Best practice on 64-bit Windows: nx = OptOut or AlwaysOn. Avoid AlwaysOff (security risk).
BIOS/UEFI:
- Ensure Execute Disable Bit/XD, NX, or No eXecute Memory Protection is Enabled.
- Labels vary by vendor: “Execute Disable”, “NX Bit”, “XD”, “eXecute Disable Bit”.
- If you changed this recently, revert to defaults.

Note: Disabling NX in BIOS can mask the symptom but weakens security and is not a fix. Keep NX enabled.

Roll back recent changes

Uninstall software or drivers added right before the BSOD began:
- GPU overlays, RGB tools, VPNs, tunneling, anti-cheats, hardware monitoring, overclock utilities.
In Device Manager, right-click devices -> Properties -> Driver -> Roll Back Driver if available.

Update core drivers (cleanly)

Chipset drivers (Intel/AMD), storage/NVMe/RAID, LAN/Wi‑Fi, and GPU.
Use vendor sites:
- Intel Driver & Support Assistant or AMD Chipset Drivers
- GPU: NVIDIA/AMD/Intel
- Storage/NVMe: Samsung, WD, Intel RST/VD, AMD RAID
For GPU, perform a clean install:
- Use DDU (Display Driver Uninstaller) in Safe Mode.
- Reinstall the latest WHQL driver.

Remove known-problem drivers

In Device Manager, enable “View -> Show hidden devices”.
Uninstall leftover phantom devices, old game controllers, obsolete VPN/tunneling adapters.
Remove any unsigned or test-signed drivers if not essential.

Clean boot to isolate conflicts

Press Win+R -> msconfig -> Services tab -> check Hide all Microsoft services -> Disable all.
Startup tab -> Open Task Manager -> Disable all startup apps.
Reboot and test. If stable, re-enable items one-by-one to find the offender.

Memory stability checks

Disable XMP/EXPO and any CPU overclock or undervolt. Load BIOS defaults temporarily.
Run Windows Memory Diagnostic:
- Press Win+R -> mdsched.exe -> Restart now and check for problems.
For deeper testing, use MemTest86 (USB boot) for at least one full pass; ideally overnight.
If errors appear, test sticks individually and in different slots. Replace faulty RAM.

Storage integrity and firmware

Ensure system SSD/HDD firmware is current (vendor utility).
If you use third-party NVMe/RAID drivers, try current vendor release or switch to Microsoft Standard NVMe Controller for testing.
Re-run:

sfc /scannow
DISM /Online /Cleanup-Image /RestoreHealth
chkdsk C: /scan

Scan for malware and rootkits

Windows Security -> Virus & threat protection -> Microsoft Defender Offline scan.
Optionally, use a reputable on-demand scanner (e.g., ESET Online Scanner, Malwarebytes) for a second opinion.

Minidump collection and analysis

Ensure Small memory dump (256 KB) is enabled:
- Control Panel -> System -> Advanced system settings -> Startup and Recovery -> Settings -> Write debugging information: Small memory dump (256 KB).
- Confirm page file on C: is system-managed (or at least 800 MB) and folder C:\Windows\Minidump exists.
Reproduce the BSOD. Locate dumps in C:\Windows\Minidump.
Quick analysis with BlueScreenView or WhoCrashed:
- Identify the likely faulting driver/module listed at the top.
Deeper analysis with WinDbg (Preview):
- Install Debugging Tools for Windows (via Windows SDK).
- Open WinDbg (Preview) -> File -> Open dump file -> select the .dmp.
- In the command window:

.symfix
.reload
!analyze -v
lmvm

Look for “Probably caused by” and check timestamps, vendor info, and stack trace. Any third-party kernel driver at the top is a prime suspect.

Repair or replace the offending driver/software

If dumps point to a specific driver (e.g., netkvm.sys, nvlddmkm.sys, storport miniport, anti-cheat), update it from the vendor or remove the associated software temporarily to confirm.
For persistent offender drivers with no updates, contact the vendor or replace the software.

BIOS/UEFI update and settings sanity check

Update BIOS/UEFI from your motherboard or OEM support page. Read release notes for memory compatibility or microcode fixes.
Re-enable NX/XD, disable experimental toggles, ensure CSM/Legacy is off unless required, and use default memory training.

System Restore or Known Good state

If the issue started recently, use System Restore:
- Win+R -> rstrui.exe -> choose a restore point from before the BSOD started.
Alternatively, uninstall recent Windows updates (Settings -> Windows Update -> Update history -> Uninstall updates) to test.

In-place upgrade repair (keeps apps and files)

Download the Windows 10/11 Media Creation Tool or ISO, run setup.exe within Windows.
Choose Keep personal files and apps.
This refreshes system files and drivers while preserving your data.

Last resort: Clean install

Back up data, export licenses/keys, capture driver lists.
Create a bootable USB with the Media Creation Tool.
Install fresh, then apply drivers slowly, testing stability after each.

Advanced Diagnostics

If the problem persists, use these to pinpoint root causes.

Driver Verifier Manager (advanced)
- Warning: Driver Verifier can cause deliberate BSODs to expose bad drivers. Use only when you can recover to Safe Mode.
- Steps:
  - Win+R -> verifier -> Create standard settings -> Automatically select unsigned drivers OR Select driver names from a list and choose non-Microsoft third-party drivers.
  - Reboot and reproduce. After a crash, inspect the new minidump; it should identify the misbehaving driver more clearly.
- To turn off Driver Verifier:
  - Safe Mode -> Elevated Command Prompt:

verifier /reset

Event Viewer and Reliability Monitor
- Event Viewer -> Windows Logs -> System -> Filter for Event ID 1001 (BugCheck) and driver/service errors around the crash.
- Run Reliability Monitor (perfmon /rel) to see a timeline of crashes and recent changes.
Hardware stress and isolation
- Test each RAM module individually; swap slots.
- Stress GPU (e.g., using a vendor stress tool), but monitor for thermal issues.
- If you have multiple drives, disconnect non-OS drives to rule out controller conflicts.
DEP/NX compatibility testing (temporary, not recommended as a fix)
- For testing only, you can set user-mode DEP to OptOut if it was AlwaysOn, then reboot:

bcdedit /set nx OptOut

Do not use AlwaysOff on modern systems. Return to a secure setting after testing.

When to Seek Professional Help

Consider pro-level assistance or hardware replacement if:

MemTest86 shows errors even after disabling XMP/overclocks.
Minidumps blame different, unrelated modules each crash (classic sign of memory or motherboard issues).
You see WHEA errors or machine checks in Event Viewer indicating hardware faults.
BSODs persist after an in-place upgrade repair and clean driver stack.
The system crashes before you can collect dumps, even in Safe Mode.

A technician can bench-test RAM, CPU, and motherboard; update firmware with lab tools; or swap components to isolate the failure quickly.

Prevention Tips

Keep NX/XD enabled in BIOS and avoid disabling DEP.
Update chipset, storage, and GPU drivers from vendor sites—not from random driver “updaters”.
Apply Windows updates regularly, but delay major releases on production machines until stability is confirmed.
Avoid mixing overclocking with mission-critical workflows; validate stability thoroughly if you do.
Maintain good backups (File History, OneDrive, or image backups).
Before installing low-level software (VPNs, anti-cheat, hypervisors, overlay tools), create a System Restore point.
Replace aging SSDs/HDDs and check their health periodically with vendor tools.
Keep BIOS/UEFI reasonably current, especially for memory compatibility updates.

Conclusion

The ATTEMPTED_EXECUTE_OF_NOEXECUTE_MEMORY BSOD signals that something tried to execute code from non-executable memory—most often caused by a bad driver or memory corruption. By confirming NX/DEP settings, updating or rolling back drivers, checking RAM stability, analyzing minidumps with WinDbg or BlueScreenView, and methodically removing conflicts, you can fix the root cause on Windows 10/11.

Take your time, follow the steps in order, and don’t be discouraged: most BSODs are fixable with the right approach. If hardware issues surface, addressing them will restore stability for good.

FAQ

Can I ignore the ATTEMPTED_EXECUTE_OF_NOEXECUTE_MEMORY BSOD?

No. While you might get back to the desktop after a reboot, ignoring it risks data corruption and more frequent crashes. This BSOD often points to a defective driver or unstable memory that needs immediate attention.

Does this error mean my RAM is failing?

Not necessarily. It can be caused by bad RAM, but it’s frequently due to buggy drivers or software that corrupts memory. Run Windows Memory Diagnostic and, ideally, MemTest86. If memory tests pass and dumps point to a specific driver, focus there first.

Should I disable DEP or the NX bit to stop the BSOD?

No. Disabling DEP/NX reduces security and only masks the symptom. The real fix is to identify and repair the faulty driver, configuration, or hardware. Keep NX/XD enabled in BIOS and DEP at OptOut or AlwaysOn.

Why didn’t Windows create a minidump?

Common reasons: no page file on C:, page file too small, or crashes occurring too early. Ensure a system-managed page file on C:, set dump type to Small memory dump (256 KB), and make sure the folder C:\Windows\Minidump exists. Then reproduce the crash.

Is a clean install required to fix this?

Usually not. Most cases resolve with driver updates/removal, BIOS updates, RAM testing, and an in-place upgrade repair. If problems persist across all steps and hardware checks, a clean install can eliminate deep software conflicts.

Quick Commands Reference

System File Checker: