MEMORY_MANAGEMENT (0x0000001A): Meaning, Parameters, and Troubleshooting

Quick answer

MEMORY_MANAGEMENT is Windows bug check 0x0000001A. It means Windows detected a severe memory-management error. The most useful detail is usually Parameter 1 (Arg1 in WinDbg): it identifies the particular violation. Depending on that value, the problem may involve corrupted page tables, an invalid operation by a driver, a failed page-in with a CRC error, or another memory-management structure. The stop-code name alone does not prove that a RAM module is defective. Microsoft Learn

What does “memory management” mean here?

Windows tracks which physical memory pages exist, how virtual addresses map to them, and which parts of memory are in use. Among the structures involved are page table entries (PTEs), which help describe address mappings, and page frame numbers (PFNs), which identify physical pages. A memory descriptor list (MDL) describes pages involved in certain memory and I/O operations.

Bug check 0x1A covers several distinct violations involving these mechanisms. That is why two computers showing the same MEMORY_MANAGEMENT blue screen may need different investigations. Microsoft’s table makes Parameter 1 the key to telling those cases apart. Microsoft Learn

How to read the four parameters

A crash report may display the values as Arg1 through Arg4:

Do not interpret Parameters 2–4 before identifying Parameter 1. For example, Parameter 2 is a pagefile offset when Parameter 1 is 0x3F, but it is the address of a PTE when Parameter 1 is 0x41792. Microsoft Learn

Selected Parameter 1 values and what they indicate

Microsoft documents many subcodes. The following table covers useful examples from its current reference; it is not the complete list. Use the full Microsoft parameter table for a value that is not shown here. Microsoft Learn

These subcodes show why “MEMORY_MANAGEMENT means bad RAM” is too broad. Microsoft explicitly describes some cases as probable hardware errors, while others describe an illegal action by a caller or driver. Even when a structure is corrupted, further analysis is needed to determine what corrupted it. Microsoft Learn

A note about older subcodes

Microsoft separately lists Parameter 1 values used in previous Windows versions. For instance, its historical table includes 0x5200, associated with corruption of a free pool block that might result from a driver’s write after free or an overrun. Match the subcode to the Windows version and Microsoft’s correct section before using an older explanation for a current crash. Microsoft Learn

What can cause a MEMORY_MANAGEMENT blue screen?

The immediate reason is the violation represented by Parameter 1. The underlying source varies. Based on Microsoft’s documented subcodes, investigations can lead toward: Microsoft Learn

• Physical-memory or other hardware problems: Microsoft calls hardware error probable for certain values, including 0x31 and 0x403.
• Driver errors: Some values explicitly describe an invalid driver operation, such as mapping an unlocked physical page (0x1233).
• Corrupted memory-management structures: Several values identify damage to PTEs, PFNs, page tables, working-set data, or related structures. The damaged structure is the finding, not necessarily the original source of damage.
• A page-in integrity failure: 0x3F identifies a CRC mismatch during an inpage operation and provides the observed and expected CRC values.

The correct next step follows the subcode and crash evidence. A generic list of replacement parts cannot substitute for that information.

Troubleshooting for a Windows PC

1. Record the full error, including Parameter 1

Write down 0x0000001A, any displayed driver name, when the crash occurred, and recent system changes. If you have a crash dump, preserve it. A technician can use the dump to obtain the parameters even when the blue screen shows only the stop-code name.

2. Check for a pattern

Did the crashes begin after adding RAM, installing a device, changing a driver, or updating firmware? Do they happen while starting Windows, under load, or during a particular task? These observations do not prove a cause, but they help you choose what to test first.

3. Run Windows Memory Diagnostic when appropriate

Microsoft specifically suggests Windows Memory Diagnostic for bug check 0x1A to check for problems affecting physical memory modules. Search Windows for Windows Memory Diagnostic, run it, and review the result after the computer restarts. A reported memory error is a concrete lead; a clean result does not automatically explain away every possible driver or memory problem. Microsoft Learn

4. Investigate recent driver or hardware changes

If the failure began immediately after a specific change, check the relevant vendor’s driver and compatibility information, or reverse the change to see whether the crashes stop. Keep track of each change and its result. This is especially useful when a dump points to an operation performed by a driver, such as an invalid MDL or mapping request.

5. Seek dump analysis if it persists

Repeated MEMORY_MANAGEMENT crashes, especially with differing subcodes, warrant analysis of the actual dumps. The investigation should establish whether the same structure, code path, or device repeatedly appears before replacing components or reinstalling Windows.

Investigating 0x1A in WinDbg

Open the dump and start with:

!analyze -v
.bugcheck

!analyze -v provides detailed bug-check analysis; .bugcheck displays the bug-check code and arguments. First identify Arg1 and find its entry in Microsoft’s table. Then read Arg2–Arg4 according to that entry, and examine the call stack for a plausible path to the violation. Microsoft recommends !analyze for this stop code. Microsoft Learn

Depending on the subcode and the available dump data, additional WinDbg commands may help:

!pte <PTE-or-virtual-address>
!pfn <page-frame-number>

!pte inspects page-table information, while !pfn displays a page-frame entry. Supply an address or PFN that the specific subcode actually identifies; do not treat every parameter as interchangeable. Some structures may be unavailable in a small dump, and a damaged structure can produce incomplete output. Microsoft Learn

For example:

• With Arg1 = 0x41792, Microsoft identifies Arg2 as a PTE address. Inspecting that PTE is relevant.
• With Arg1 = 0x1233, Microsoft identifies Arg2 as the PFN of a physical page a driver attempted to map without locking it. Review the driver’s mapping and page-locking path.
• With Arg1 = 0x3F, focus on the failed page-in and the recorded versus expected CRC values; a PTE command by itself would not explain the CRC mismatch. Microsoft Learn

Frequently asked questions

Does 0x0000001A always mean bad RAM?

No. Microsoft documents a range of Parameter 1 values, including probable hardware errors, corrupted paging structures, and invalid driver operations. Windows Memory Diagnostic is a sensible test, but the subcode and dump determine the direction of the investigation. Microsoft Learn

Why do two MEMORY_MANAGEMENT crashes show different arguments?

Because Parameter 1 selects a specific violation, and the remaining parameters carry details relevant to that violation. A change in Arg1 can indicate a different kind of detected failure even when the blue-screen name stays the same. Microsoft Learn

What do PTE and PFN stand for?

PTE means page table entry; PFN means page frame number. Microsoft uses both terms throughout its 0x1A parameter descriptions, and WinDbg provides commands to inspect related data. Microsoft Learn

Can a driver cause this error?

Yes, in some cases. Microsoft explicitly describes driver behavior for subcodes such as 0x1233. For other subcodes, the presence of a driver on a stack is only a clue; it must be assessed alongside the recorded violation. Microsoft Learn

What if Windows Memory Diagnostic finds no error?

Continue with the Parameter 1 value and dump evidence. A negative result from one physical-memory check does not identify the cause of a driver operation, CRC mismatch, or corrupted paging structure. This is an inference from the range of distinct violations Microsoft documents for 0x1A. Microsoft Learn

Summary

MEMORY_MANAGEMENT (0x0000001A) signals a serious memory-management violation. Its first parameter is essential: it determines both the failure category and how to read the other three parameters. Use the specific subcode, crash dump, and any relevant hardware or driver history to guide troubleshooting. Microsoft recommends !analyze for investigation and Windows Memory Diagnostic when checking physical memory is appropriate. Microsoft Learn

Sources

• Microsoft Learn: Bug Check 0x1A — MEMORY_MANAGEMENT
• Microsoft Learn: !analyze in WinDbg
• Microsoft Learn: !pte debugger command
• Microsoft Learn: !pfn debugger command
• Microsoft Support: Resolving Blue Screen errors in Windows