How to fix the Reference By Pointer BSOD (0x18) in Windows 10 and 11

REFERENCE_BY_POINTER, bug check 0x18, means a driver released a Windows kernel object more times than it took it, so Windows stopped the PC. Almost always a third-party driver is behind it, such as security, VPN, audio, graphics or game tools. Find that driver in the crash dump, then update or remove it.

Facts checked on 16 October 2026. Steps written for Windows 11 (25H2 and 26H2) and Windows 10 22H2.

What the Reference By Pointer blue screen (0x18) means

Microsoft's bug check reference says that the REFERENCE_BY_POINTER bug check has a value of 0x00000018 and that it indicates the reference count of an object is illegal for the current state of the object. In plain words: Windows keeps a counter for every kernel object, such as a file, a device or a process, and a driver broke that counter.

Each time a driver uses a pointer to an object, it calls a kernel routine that raises the count by one. When it is done, it calls another routine that lowers it by one. The calls must match. If a driver lowers the count once too often, the count reaches zero while handles to the object are still open, or drops below zero, and Windows stops the PC rather than keep going with a broken object.

Why the REFERENCE_BY_POINTER error happens: causes, most common first

Only code running in kernel mode can break a reference count, so a normal app cannot cause 0x18 by itself. The suspects are drivers: the ones that come with hardware, and the hidden ones that security, VPN, backup, virtualization, monitoring and anti-cheat software install.

Find the driver behind 0x18 in the crash dump

Microsoft's advice for 0x18 starts with the debugger: the !analyze command shows information about the bug check that helps find the root cause. You need no developer skills for the first look. It takes about ten minutes if the PC still starts.

1. Open File Explorer and go to C:\Windows\Minidump. Each .dmp file is one crash, named by its date.
2. Install Microsoft's debugger: open Terminal and run winget install Microsoft.WinDbg.
3. Start WinDbg as administrator, select File > Open dump file and open the newest .dmp file.
4. Type !analyze -v in the command box and press Enter.
5. Write down the lines IMAGE_NAME, MODULE_NAME, PROCESS_NAME and FAILURE_BUCKET_ID.

No debugger? Microsoft also suggests the System log in Event Viewer. Press Win + X, select Event Viewer, open Windows Logs > System and look at the errors just before the crash time. A driver or device that fails there again and again is a good lead.

How to fix the Reference By Pointer blue screen in Windows

Start with Fix 1 if the dump names a driver. Fix 2 and Fix 3 find the cause when it does not. Fix 4 unmasks a hidden driver. Fix 5 is for a PC that no longer starts. Fixes 6 to 8 are general repairs, in order of cost.

Fix 1. Update, roll back or remove the driver the crash points at

15 minutesLow riskThe dump, Event Viewer or the stop screen names a driver that is not part of Windows, or crashes began after a driver update.

Microsoft says 0x18 is typically caused by a driver that lowers an object's reference count too many times, and advises updating or disabling a driver named in the bug check. A newer version often has the matching calls fixed; an older one avoids a new bug.

1. Search the web for the .sys file name to learn which device or program it belongs to.
2. Right-click Start and select Device Manager. Look for devices with a yellow exclamation mark first, as Microsoft's stop code checklist advises.
3. Expand the category of the device, such as Display adapters or Sound, video and game controllers, right-click it and select Properties.
4. On the Driver tab, select Roll Back Driver if the crashes began after a driver update.
5. Otherwise download the newest driver for your exact model from the device or PC maker's site and install it.
6. If the file belongs to a program rather than a device, update that program or uninstall it for a test: Uninstall a program or app in Windows
7. Restart and use the PC as usual. Step by step with screenshots: Update, roll back or reinstall a driver

Fix 2. Find the program behind it with a clean boot

30 minutes plus a few days of useLow riskCrashes began after you installed security, VPN, backup, tuning or game software, or the dump names only Windows files.

Many programs load their own kernel drivers through services. A clean boot starts Windows with only Microsoft services, so if 0x18 stops, one of the disabled services is the cause.

1. Press Win + R, type msconfig and press Enter.
2. On the Services tab, tick Hide all Microsoft services, then select Disable all.
3. On the Startup tab, select Open Task Manager and disable every startup app.
4. Select OK in System Configuration and restart.
5. If the PC is stable, turn the services back on a few at a time until the crash returns. The last group holds the cause. Full method: How to perform a clean boot in Windows

Fix 3. Remove new hardware and undo the latest update

15 minutesLow riskThe first crash came soon after you added a device or after a Windows or driver update.

Microsoft's 0x18 page says to confirm that new hardware is compatible with your Windows version. A new device brings a new driver, and an update can replace a driver that used to work.

1. Shut down the PC, disconnect the device you added last, such as a dock, audio interface, capture card or USB adapter, and start again.
2. Open Settings > Windows Update > Update history (on Windows 10: Settings > Update & Security > Windows Update > View update history).
3. Compare the date of the newest quality or driver update with the date of the first crash.
4. If they match, select Uninstall updates and remove it. Step by step: How to uninstall a Windows update
5. Pause updates for a week so it does not return until a fixed version arrives.

Fix 4. Unmask a hidden driver with Driver Verifier

30 minutes plus waiting for a crashRead the warningCrashes keep coming, the dump names only ntkrnlmp.exe or ntoskrnl.exe, and Fixes 1 to 3 found nothing.

Driver Verifier watches drivers closely and stops the PC at the moment a driver does something wrong. Microsoft's support engineers recommend it for 0x18 so that the next dump names the faulty driver instead of the Windows kernel.

1. Press Win + R, type sysdm.cpl and press Enter. Open Advanced > Startup and Recovery > Settings and set Write debugging information to Kernel memory dump.
2. Open Terminal (Admin) and run verifier.
3. Select Create standard settings, then Select driver names from a list.
4. Tick all drivers whose provider is not Microsoft Corporation, select Finish and restart.
5. Use the PC as usual until it crashes, then read the new dump as in the section above.
6. Turn Driver Verifier off when you are done: run verifier /reset and restart.

In Terminal (Admin), to turn Driver Verifier off:

verifier /reset

Fix 5. Repair Windows from the recovery environment when it will not start

30 minutesRead the warningThe stop code appears during every startup, or only Safe Mode works.

When the faulty driver loads at startup, Windows crashes before you can remove it. Safe Mode loads only basic drivers, and the recovery environment can undo changes from outside Windows.

1. Turn the PC on and, when the logo appears, hold the power button until it shuts down. Do this twice; the third start opens Automatic Repair.
2. Select Advanced options > Troubleshoot > Advanced options > Startup Settings > Restart, then press 4 for Safe Mode: Start Windows or a Mac in Safe Mode
3. In Safe Mode, roll back or uninstall the driver or program from Fix 1 and Fix 2, then restart normally.
4. If Safe Mode does not open either, run Startup Repair from the same menu: Run Startup Repair
5. If that fails, use Uninstall Updates or System Restore with a point from before the first crash: Undo recent changes with System Restore

Fix 6. Repair damaged Windows system files with DISM and SFC

20 minutesNo riskNo third-party driver was found, an update failed, or SFC has never run on this PC.

0x18 rarely comes from Windows itself, but a damaged kernel or driver file can act like a buggy driver. This repair rules it out at no cost.

DISM fetches clean copies of Windows components first, then SFC replaces damaged system files with them. Step by step with screenshots: Run DISM and SFC to repair Windows system files

In Terminal (Admin), one after the other:

DISM.exe /Online /Cleanup-Image /RestoreHealth
sfc /scannow

Fix 7. Rule out faulty memory and overclocking

60 minutes or moreLow riskStop codes change from crash to crash, or nothing above helped.

Microsoft treats 0x18 as a driver bug, so hardware is a rare cause. Still, bad RAM can corrupt any kernel object, including its reference count, and then any driver looks guilty.

1. Reset every CPU and GPU overclock to default, and turn off the memory profile (XMP or EXPO) in the BIOS for the test.
2. Test the RAM with the tool built into Windows: How to test your RAM with Windows Memory Diagnostic
3. Check the system disk for errors: Check a disk for errors (chkdsk)
4. Keep 10 to 15 % of the system disk free, as Microsoft's stop code checklist advises.
5. Update the BIOS and chipset driver from your PC or motherboard maker's support page.

Fix 8. Reinstall Windows and keep your files

60 minutes or moreRead the warningEvery fix above failed and the crashes continue.

A reinstall replaces the whole driver store and removes every third-party driver at once, including one that no dump could name. Your personal files stay.

1. Back up your files and note the apps you will need again.
2. Open Settings > System > Recovery (on Windows 10: Settings > Update & Security > Recovery).
3. On Windows 11, select Reinstall now under Fix problems using Windows Update if your version shows it, for a repair that keeps files and apps.
4. If that is missing or did not help, select Reset PC, then Keep my files and Cloud download.
5. Afterwards, install drivers from the device makers first, then your apps one at a time. Full method: Reinstall Windows without losing files

Still crashing: what to collect and whom to ask

Microsoft's page says the driver must match its reference and dereference calls, which only the driver's maker can fix. So the report goes to the maker of the driver the dump names. Collect the facts once.

• The three newest .dmp files from C:\Windows\Minidump, and C:\Windows\MEMORY.DMP if Driver Verifier made one.
• The IMAGE_NAME, MODULE_NAME and FAILURE_BUCKET_ID lines from !analyze -v.
• Your Windows edition and build from Settings > System > About.
• The versions of the drivers and security tools you suspect.
• What you were doing at each crash: a game, a VPN connection, a backup, shutdown.

How to keep the Reference By Pointer BSOD from coming back

Windows 10 left support on 14 October 2025. A PC that stays on Windows 10 gets kernel fixes only through Extended Security Updates, and hardware makers are slowly stopping driver updates for it.

Frequently asked questions

What does reference by pointer mean?

It means a driver broke the counter Windows keeps for a kernel object. Every time a driver uses a pointer to an object, the count goes up by one, and when it is done, the count goes down by one. When a driver lowers it one time too many, the count reaches zero while the object is still open, or drops below zero. Windows then stops with bug check 0x18 to protect itself and your data.

What is stop code 0x18 or 0x00000018?

0x18 is the number of the REFERENCE_BY_POINTER bug check, and 0x00000018 is the same value written with eight digits. The stop screen shows the name, while Event Viewer, Reliability Monitor and WinDbg often show the number, sometimes as REFERENCE_BY_POINTER (18). They are the same problem with the same fixes. If WinDbg prints 0x18_OVER_DEREFERENCE, a driver released an object too many times.

Is the Reference By Pointer BSOD a hardware problem?

Usually not. Microsoft describes 0x18 as a driver bug: a driver makes extra calls that release an object. Hardware matters only indirectly, when a new device brings a faulty driver, or in rare cases when bad RAM corrupts memory. If the stop code changes from crash to crash, test the memory as in Fix 7. If it is always REFERENCE_BY_POINTER, look for a driver first.

Why does the dump blame ntoskrnl.exe?

Because the Windows kernel is where the broken count was noticed, not where it was broken. The kernel file ntoskrnl.exe, or ntkrnlmp.exe on most PCs, runs the routine that lowers the count, so it is on top of every 0x18 crash. A Microsoft support engineer explained that the faulty driver is then not visible in the dump. Driver Verifier in Fix 4 catches the driver at the moment it makes the mistake.

Can antivirus or VPN software cause REFERENCE_BY_POINTER?

Yes, they are common suspects, because they install kernel drivers that filter files and network traffic. A bug in such a driver can release an object too often. If the crashes began after you installed or updated security or VPN software, update it first, then test with a clean boot as in Fix 2. Do not leave the PC without protection: check that Microsoft Defender is on after you remove another antivirus.

Is the reference by pointer error different on Windows 10 and Windows 11?

The code, its meaning and its fixes are the same on Windows 10 and Windows 11. What differs is the screen: on Windows 11 24H2 and later the stop screen is black instead of blue. Some settings paths also differ, and this guide gives both. Windows 10 left support on 14 October 2025, so a Windows 10 PC gets fewer driver updates, which can make an old driver bug last longer.

My PC crashes with REFERENCE_BY_POINTER on startup. What now?

A crash before the desktop means a driver that loads at startup is at fault. Let Windows open Automatic Repair by interrupting the start twice, then go to Startup Settings and start in Safe Mode, which loads only basic drivers. From there, roll back or remove the suspect driver or program. If Safe Mode fails too, use Startup Repair, Uninstall Updates or System Restore, as Fix 5 explains.

Is REFERENCE_BY_POINTER a sign of a virus?

Not usually. The stop code comes from Windows when a driver breaks a reference count, and almost always the driver is a normal, signed one with a bug. Malware that loads its own kernel driver could in theory cause it, but nothing ties 0x18 to malware in particular. If you also see unknown programs, pop-ups or a disabled antivirus, run a full Microsoft Defender scan: How to scan for malware with Microsoft Defender

Can I just ignore a single reference by pointer crash?

One crash with no repeat can be left alone. Microsoft says that in most cases the restart solves the problem and no further action is needed. Still, copy the newest file from C:\Windows\Minidump while it is there, because it names the driver if the crash returns. When the same stop code comes back, follow the fixes on this page, starting with the driver the dump names.

I don't speak English. What should I do about this screen?

This page is about the stop code REFERENCE_BY_POINTER (0x18) in Windows, also asked as "как это исправить", "jak naprawić ten błąd" or "máy bị gì". In short: update or remove the driver the crash dump names, test with a clean boot, and undo new hardware or the latest update. If the PC does not start, use Safe Mode. A browser translation of this page shows every step in your language.