CRITICAL_PROCESS_DIED (stop code 0xEF) is Windows discovering that one of its essential processes — the ones the entire system is built on — has died unexpectedly. Rather than run in a crippled state, Windows stops everything immediately. CRITICAL_PROCESS_DIED (stop code 0xEF) is Windows discovering that one of its essential processes — the ones the entire system is built on — has died unexpectedly. Rather than run in a crippled state, Windows stops everything immediately.

This one is almost always software: corrupted files, a bad update, a hostile driver, or malware. The fixes below hunt those down in the order of likelihood, including what to do when Windows will not boot at all. This one is almost always software: corrupted files, a bad update, a hostile driver, or malware. The fixes below hunt those down in order of likelihood, including what to do when Windows will not boot at all.

Why this happens

  • Corrupted system files. Damage to the binaries that critical processes load kills them at startup.
  • A failed or partial Windows update. Interrupted updates leave critical components in a half-replaced state.
  • Malware killing system processes. Some malware targets security and system processes directly.
  • A bad driver interfering at boot. Storage or filter drivers that break the boot chain take critical processes down with them.
  • Failing system drive. If the drive cannot deliver the process binaries intact, they crash on load.
  • Faulty RAM. Corrupted process memory kills critical processes randomly — the least common but worth checking.

How to fix it

Work through these in order, from the quickest and most likely fixes to the deeper ones. Stop as soon as the crashes stop.

Fix 1: Boot into Safe Mode and run SFC/DISM

Safe Mode loads a minimal driver set, which often gets you booted when normal mode cannot. Safe Mode loads a minimal driver set, which often gets you booted when normal mode cannot — and SFC works fine there.

  1. Interrupt the boot three times (hold power during the Windows logo) to reach Automatic Repair > Advanced options > Startup Settings > Restart, then press 4 for Safe Mode. Our Safe Mode guide covers every method.
  2. In Safe Mode, open an elevated Command Prompt and run sfc /scannow.
  3. Follow with DISM /Online /Cleanup-Image /RestoreHealth.
  4. Restart normally. If SFC repaired files, this alone often ends the crashes.

Fix 2: Scan thoroughly for malware

Because malware genuinely causes this stop code, scan before assuming a driver issue. Because malware genuinely causes this stop code, scan before assuming a driver issue — the offline scan catches what the regular one misses.

  1. In Safe Mode with Networking, open Windows Security > Virus & threat protection > Scan options.
  2. Run a Full scan first.
  3. Follow with the Microsoft Defender Offline scan option, which reboots into a clean environment outside Windows.
  4. Remove anything found, restart, and test. If the scanner itself is being killed, use the offline scan — that is exactly what it is for.

Fix 3: Uninstall the most recent Windows update

If the crashes started within a day of an update, the update is the prime suspect. If the crashes started within a day of an update, the update is the prime suspect — the timing correlation is the strongest evidence you will get.

  1. Boot into the recovery environment (Troubleshoot > Advanced options > Uninstall Updates).
  2. Choose Uninstall latest quality update first; if crashes persist, Uninstall latest feature update.
  3. Back in Windows, pause updates for a week: Settings > Windows Update > Pause updates.
  4. Check the Microsoft Update Catalog later for a revised version of the problematic update.

Fix 4: Run a clean boot to isolate the culprit

A clean boot disables all third-party startup items and services — if the crash stops, one of them did it. A clean boot disables all third-party startup items and services — if the crash stops, one of them did it, and the halving process finds it fast.

  1. Press Win + R, type msconfig, and press Enter.
  2. On the Services tab, tick Hide all Microsoft services, then click Disable all.
  3. On the Startup tab, click Open Task Manager and disable every startup item.
  4. Restart. If stable, re-enable items in halves until the crash returns — the last half contains your culprit.

Fix 5: Check the drive’s health

Critical processes die when their files cannot be read intact. Critical processes die when their files cannot be read intact — and chkdsk plus SMART data tell you whether the drive can still be trusted.

  1. From the recovery command prompt, run chkdsk C: /f /r.
  2. Back in Windows, run wmic diskdrive get status — anything other than OK means the drive is failing.
  3. Use your SSD maker’s toolbox for detailed SMART data. A dying system drive explains crashes that survive SFC and DISM.

Fix 6: Test the RAM

The last hardware check, for crashes that resist every software fix. The last hardware check, for crashes that resist every software fix — RAM faults here tend to kill different processes each time, another useful pattern.

  1. Press Win + R, type mdsched.exe, and press Enter.
  2. Choose Restart now and check for problems.
  3. Errors here mean the RAM is corrupting critical processes in memory — reseat or replace the sticks.

Fix 7: Perform an in-place repair upgrade

The final software fix: refresh Windows while keeping everything. From working Windows or Safe Mode, the in-place upgrade refreshes every system binary while keeping your files and programs — the deepest software repair short of wiping.

  1. From working Windows (or Safe Mode), download the installer from the Windows 11 download page .
  2. Run setup, choose Keep personal files and apps, and let it complete.
  3. Reinstall your drivers afterward. If even this fails, back up your data and do a clean install — or take the machine to a repair shop, since persistent 0xEF after all this points at deep hardware trouble. Our general BSOD guide has more on reading these errors.

Closing

CRITICAL_PROCESS_DIED looks catastrophic, but it is usually Windows tripping over its own damaged files or a bad update — both fixable without losing anything. Work from Safe Mode outward: repair the files, remove the bad update, scan for malware, and only then suspect the hardware. If you reach the end of this list and still crash, stop and get professional diagnostics — persistent 0xEF with clean files, clean RAM, and a healthy drive means something subtle is failing, and guessing further just wastes money.

Frequently asked questions

What counts as a critical process in Windows?
Processes like csrss.exe, wininit.exe, smss.exe, and services.exe are critical — Windows cannot function without them. If any of them terminates unexpectedly, the kernel halts the system immediately with stop code 0xEF rather than limp along in a broken state.
Can a virus cause CRITICAL_PROCESS_DIED?
Yes, and this is one of the stop codes where malware is a genuinely plausible cause — some malware kills security processes, and the system dies as collateral. Run a full Windows Security scan plus a second-opinion scan early in your troubleshooting, not as an afterthought.
Why does this error often happen right after a Windows update?
Updates replace the very system files these critical processes load. If an update is interrupted or a driver conflicts with the new binaries, a critical process can fail to start or crash on launch — and the boot loop begins. The update history is always worth checking.
Is CRITICAL_PROCESS_DIED a hardware or software problem?
Overwhelmingly software: corrupted system files, bad updates, driver conflicts, or malware. Hardware (RAM, drive) can do it, but only after the software causes are exhausted should you suspect the hardware — test in that order.