What ATTEMPTED_WRITE_TO_READONLY_MEMORY means
Bug check 0xBE means a driver attempted to write to a read-only memory segment. Microsoft’s reference says that when Windows can identify the offending driver, it prints the driver’s name on the blue screen, which makes this one of the more traceable stop codes. The name shown is the code that was running, so it is where to start rather than proof of the root cause.
Common causes
- A driver with a defect that writes to memory it should only read
- An outdated or incompatible driver, often after a Windows update
- Security, virtualization or overlay software that hooks deeply into the system
- Less often, unreliable memory that corrupts data the driver depends on
How to fix ATTEMPTED_WRITE_TO_READONLY_MEMORY
Work through these in order and test after each one. Stopping as soon as the crashes stop tells you which change mattered.
- Note the file name on the blue screen. If the screen shows a line such as "What failed" followed by a .sys file, write it down. Searching that file name shows which driver it belongs to, which tells you what to update or remove. The named file is the code that crashed, which is not always the root cause.
- Undo the most recent change. If the blue screens began after a Windows update, a new driver or new software, remove that change first. Uninstall the update from Settings, Windows Update, Update history, or roll a driver back in Device Manager (right-click the device, Properties, Driver, Roll Back Driver).
- Install an updated driver or software version. Search the file name shown on the blue screen to find which driver or program it belongs to, then install the current version from the device, PC or software maker. If no update exists, uninstall that software and test without it.
- Repair Windows system files. Open Terminal (Admin) and run
sfc /scannow. If it reports damage it could not repair, runDISM /Online /Cleanup-Image /RestoreHealth, restart, and runsfc /scannowonce more. - Return the PC to stock settings. Reset the BIOS to defaults, then leave XMP or EXPO, CPU or GPU overclocks and undervolts (including per-core offsets such as Curve Optimizer) switched off while you test. If the crashes stop, re-enable one setting at a time to find the unstable one.
- Start in Safe Mode if Windows will not load. Hold Shift while choosing Restart, or let Windows fail to start three times to open the recovery menu. Choose Troubleshoot, Advanced options, Startup Settings, Restart, then Safe Mode. If Windows is stable there, a driver or startup program is the likely cause.
Reading the crash evidence for 0xBE
Microsoft’s reference gives the first parameter as the virtual address of the attempted write and the second as the contents of its page table entry. The last two are reserved. You rarely need them unless a debugger is involved.
The driver name Windows prints is stored in memory when the PC crashes and ends up in the minidump. Matching that name against the date your crashes began, in Reliability Monitor, is often enough to find the change responsible.
| What you observe | What it may suggest | Next check |
|---|---|---|
| A .sys file name is shown on the blue screen | That driver was running when the write was attempted | Identify its owner and update or remove it |
| Crashes began after a Windows update | An older driver may not suit the new build | Install the maker’s current driver, or remove the update to test |
| Crashes began after installing security or overlay software | Low-level hooks may conflict with Windows protections | Uninstall it and retest |
| No driver is named and other stop codes appear too | Memory or another component may be involved | Run a full memory test and list every stop code |
Source: Microsoft Learn: Bug Check 0xBE ATTEMPTED_WRITE_TO_READONLY_MEMORY ↗
If no driver is named and the crashes continue after updates, settings and system-file checks, keep the minidump and have it read with a debugger, which can show the address and the driver on the stack.
Not sure this is your code?
The stop code appears as text on the blue screen. If the PC restarted before you could read it, open Event Viewer, then Windows Logs, then System, and look for a BugCheck event with ID 1001. You can also search all stop codes.