REFERENCE_BY_POINTER (stop code 0x18) is one of the rarer blue screens, and its cause is refreshingly specific: a driver messed up the reference count on a kernel object. Windows uses reference counting to know when it’s safe to free memory — each driver that uses an object increments the count, and decrements when done. If a driver decrements too many times, the count goes invalid, and Windows crashes rather than risk freeing memory that’s still in use (or using memory that’s been freed).

On Lenovo laptops, this tends to involve Lenovo’s own drivers — power management, Commercial Vantage/Legion toolkits, fingerprint sensors — or third-party filters. The fixes are driver-focused and ordered by likelihood.

Why this happens

  • Buggy Lenovo utility drivers. Lenovo Vantage, Commercial Vantage, and power management drivers manipulate kernel objects; flawed versions corrupt reference counts.
  • Outdated or mismatched drivers after Windows Update. A replaced driver with different object-handling behavior breaks the counting contract.
  • Antivirus and security filter drivers. They attach to kernel objects constantly, making them prime suspects for reference-count bugs.
  • Virtualization drivers. Hyper-V, VirtualBox, and VMware drivers manage shared kernel objects and have caused 0x18 crashes.
  • Corrupted driver installations. Mismatched driver binaries from interrupted updates behave unpredictably with object lifetimes.
  • Failing RAM (rare). Memory corruption can damage the reference counts themselves — a last-resort suspect.

How to fix it

Work through these in order — start with Fix 1 and stop when the crashes stop.

Fix 1: Update Lenovo drivers with Commercial Vantage or support site

Lenovo-validated drivers are the fix for Lenovo-specific 0x18 crashes.

  1. Open Lenovo Vantage (consumer) or Commercial Vantage (ThinkPad) and run System Update.
  2. Install all driver updates, especially power management, chipset, BIOS, and fingerprint.
  3. Alternatively, visit Lenovo Support , enter your serial number, and download drivers manually.
  4. Restart after updates and test for a day — 0x18 crashes can be intermittent.
  5. Avoid mixing Lenovo drivers with generic Windows Update drivers for the same device; pick one source.

Fix 2: Identify the driver from the minidump

Get the exact culprit instead of guessing.

  1. Install WinDbg from the Microsoft Store.
  2. Set the symbol path: SRV*C:\Symbols*https://msdl.microsoft.com/download/symbols.
  3. Open the newest dump from C:\Windows\Minidump and run !analyze -v.
  4. Note IMAGE_NAME — on Lenovos, watch for Lenovo utility drivers, antivirus filters, or virtualization drivers.
  5. Run lmvm <drivername> for the driver’s version and timestamp; compare it against the latest on Lenovo Support to see how far behind it is.
  6. Update, roll back, or uninstall that specific driver.

If several dumps blame different drivers, that’s actually useful information — it points away from a single bad driver and toward memory corruption or a filter driver that touches everything. In that case, prioritize Fix 4 and the RAM test in Fix 6.

The update-triggered variant is detailed in our REFERENCE_BY_POINTER after Windows 11 update guide .

Fix 3: Uninstall or update Lenovo Vantage components

Lenovo’s own utilities are frequent 0x18 sources.

  1. Open Settings > Apps > Installed apps.
  2. Uninstall Lenovo Vantage, Lenovo Hotkeys, and any ImController-related entries you don’t need.
  3. Restart and test for several days.
  4. If crashes stop, reinstall only the Vantage components you actually use, from the Microsoft Store (newest builds).
  5. For ThinkPads, Commercial Vantage is generally more stable than the consumer Vantage app.

Fix 4: Remove antivirus and virtualization filter drivers

The two biggest third-party suspect categories.

  1. Uninstall third-party antivirus via Settings > Apps > Installed apps, using vendor cleanup tools for leftovers.
  2. If you use VirtualBox/VMware, update to the latest version — old virtual network/storage drivers are known 0x18 triggers.
  3. Disable Hyper-V temporarily to test: open Turn Windows features on or off and untick Hyper-V, then restart.
  4. Test on Microsoft Defender with no VM software for a few days.
  5. Reintroduce software one piece at a time to identify the guilty driver.

Fix 5: Roll back recent driver changes

If crashes started after an update, undo it.

  1. Open Device Manager and check devices updated around the time crashes began.
  2. Use Properties > Driver > Roll Back Driver where available.
  3. Otherwise uninstall the device (removing the driver files) and install the previous Lenovo-validated version.
  4. Pause driver updates via Settings > Windows Update > Pause updates while testing.
  5. Related black-screen issues on Lenovo hardware are covered in our black screen after Windows update guide .

Fix 6: Repair system files and test RAM

The final sweep for non-driver causes.

  1. Open Terminal (Admin) and run DISM /Online /Cleanup-Image /RestoreHealth.
  2. Then run sfc /scannow and restart.
  3. Press Windows + R, type mdsched.exe, and run the memory diagnostic.
  4. If RAM fails, replace the faulty module — corrupted reference counts can be a memory symptom.
  5. If everything passes and crashes persist, run Lenovo’s built-in hardware diagnostics (press F10 at boot on most models) to check the board.

Closing

REFERENCE_BY_POINTER is refreshingly honest for a blue screen: it tells you a driver broke the reference-counting rules, and on Lenovo laptops that driver is usually one of Lenovo’s own utilities or a security filter. Update the Lenovo driver set, identify the culprit from the dump if you want precision, and clear out filter drivers. It’s a software bug with a software fix — no hardware heroics required.

Going forward, keep Lenovo Vantage (or Commercial Vantage on ThinkPads) updated and let it manage your drivers rather than mixing sources — most 0x18 cases trace back to a driver mismatch between Lenovo’s packages and Windows Update’s replacements. And if the crashes ever return after a Windows feature update, check the driver versions first before assuming the worst; the update likely swapped a working Lenovo driver for a generic one again, and reinstalling Lenovo’s package is a ten-minute fix.

Frequently asked questions

What does REFERENCE_BY_POINTER mean?
A driver’s reference count for a kernel object went wrong — stop code 0x00000018. Windows tracks how many drivers are using each object; when a driver decrements the count too many times (or corrupts it), Windows crashes to prevent use-after-free memory corruption.
Is REFERENCE_BY_POINTER a hardware problem?
Almost never. It’s a driver bug — specifically a driver mishandling object reference counts. Outdated Lenovo drivers, antivirus filters, and virtualization drivers are the typical causes. Hardware is only suspect if every driver fix fails.
Why does it happen on Lenovo laptops after updates?
Lenovo ships custom drivers (power management, hotkeys, fingerprint) that interact with kernel objects. When Windows Update replaces one with a mismatched version, reference counting breaks. Reinstalling Lenovo’s validated driver set fixes it.
Can I find which driver causes it?
Yes — the minidump usually names it. Open the newest dump in C:\Windows\Minidump with WinDbg, run !analyze -v, and check IMAGE_NAME. On Lenovos it’s often a power management, Lenovo Vantage/Commercial Vantage driver, or antivirus filter.