It seems like your browser didn't download the required fonts. Please revise your security settings and try again.
Barracuda RMM
formerly Managed Workplace

0xC0000005 messages in Windows Events or errors

  • Last updated on

When processes or services crash, or third-party applications throw errors, it's common to see them reference an error code of 0xC0000005.

This is a Microsoft status code defined in their SDK's ntstatus.h file as follows:

// MessageId: STATUS_ACCESS_VIOLATION
// MessageText:
// The instruction at 0x%p referenced memory at 0x%p. The memory could not be %s.
#define STATUS_ACCESS_VIOLATION ((NTSTATUS)0xC0000005L) // winnt

The L at the end of the code is just a hint for C or C++ indicating that the hexadecimal should be interpreted as a Long (eg. a 64-bit number).

The MessageID is reasonably self-explanatory - 0xC0000005 is returned when a process attempts to access memory that it doesn't have rights to. To have a better idea of what this means, though, you need to see the MessageText generated at runtime.

The MessageText in Microsoft's definition indicates that it will have two memory pointer addresses listed (the 0x%ps in the message) - the instructions and the referenced memory - and a string indicating what type of access was attempted (ie. READ or WRITTEN.)

The special case to keep an eye for there is if either is all-zeroes, ie. 0x00000000. Memory address 0 is used by the OS as the Null pointer, which is often used as a placeholder for a pointer to real data, so anything that tries to read or write to it will fail. A STATUS_ACCESS_VIOLATION referencing 0x00000000 is essentially the C or C++ version of a null reference exception, meaning that some data wasn't initialized, which in turn generally means there was an issue with the faulting application (missing data in a database, bad config, or simply buggy code.)

If, on the other hand, both addresses are non-zero, there is a significant chance that the issue is either with the OS's memory-handling (meaning that the OS has become corrupt, which would need to be addressed) or with the memory itself (meaning that the RAM on the system might need to be reseated or replaced.)