How to fix Error 1662 on Windows 11

by

Troubleshooting Guide: Error 1662 — Return Address Hijack Attempt Detected (CET Shadow Stack Violation)

Why This Error Happens

Error 1662 is triggered by Hardware-Enforced Stack Protection, a feature of Intel CET (Control-flow Enforcement Technology) or AMD Shadow Stack, which is natively supported in Windows 11. This occurs when the CPU detects that a return address on the standard call stack does not match the address recorded in the protected user-mode shadow stack, indicating a potential exploit (like a ROP/JOP attack) or, more commonly, an incompatibility with legacy application code that manually manipulates the stack. Often, this is a false positive caused by older drivers, anti-cheat software, or applications compiled without full CET support.

Step-by-Step Resolution Guide

Step 1: Identify the Offending Application

  • Open Event Viewer (eventvwr.msc) and navigate to Windows Logs > System.
  • Filter for Event ID 1662 to identify the exact executable (.exe) path that triggered the fault.
  • Cross-reference the timestamp with any recently opened applications or games.

Step 2: Check for Software Updates

  • Visit the vendor’s website for the specific application identified in Step 1.
  • Look specifically for patch notes mentioning “CET support,” “Shadow Stack compatibility,” or “Windows 11 23H2/24H2 fixes.”
  • Update the software, as this is the most permanent fix, ensuring the code is compiled correctly for CFG/CET.

Step 3: Disable Hardware-Enforced Stack Protection (Application Specific)

  • If an update is unavailable, open Windows Security > App & browser control.
  • Click on Exploit protection settings.
  • Under the “Program settings” tab, locate the specific .exe (or click “Add program to customize”) and disable the Control flow guard (CFG) and Hardware-enforced Stack Protection toggles specifically for that program.

Step 4: Adjust System-Wide CET Settings (If Necessary)

  • Navigate to Windows Security > Device security > Core isolation.
  • If the issue persists across multiple legacy applications, temporarily toggle off Memory integrity or the specific “Hardware-enforced Stack Protection” system default toggle.
  • Restart the PC to apply the kernel-level changes.

Alternative or Verification Steps

  • Verification: Relaunch the specific application that caused the error and monitor the Event Viewer for 15-20 minutes to confirm Event ID 1662 no longer generates.
  • Alternative: If disabling protection is not viable for security reasons, run the application in Compatibility Mode (Right-click .exe > Properties > Compatibility > Run this program in compatibility mode for Windows 8) to force the loader to bypass certain modern hardware mitigation checks.