EUVD-2025-210885
GHSA-266q-5v9w-4g37
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Local attack vector and low privileges required to reach the IOCTL; no confidentiality or integrity impact, only availability (BSOD); matches provided vector exactly.
Primary rating from Vendor (mitre).
CVSS VectorVendor: mitre
Lifecycle Timeline
3DescriptionCVE.org
A vulnerability in the Thesycon DPC Latency Checker driver (dpc.sys) thru 1.4.0 allows local unprivileged users to cause a denial-of-service (BSOD) condition on Windows systems. The driver exposes an IOCTL interface (0x81772008) that accepts user-controlled input without validating pointers before passing them to kernel APIs. Specifically, it dereferences a user-supplied pointer and uses the resulting value in a call to ExSetTimerResolution, leading to an arbitrary kernel memory access. Exploiting this flaw results in a system crash.
AnalysisAI
Denial-of-service via unvalidated kernel pointer in the Thesycon DPC Latency Checker Windows driver (dpc.sys) through version 1.4.0 allows any local unprivileged user to crash the host system. The driver's IOCTL handler at code 0x81772008 accepts a user-supplied pointer, dereferences it without validation, and passes the resulting value to the kernel API ExSetTimerResolution - causing an arbitrary kernel memory access that triggers an immediate BSOD. No public exploitation in the wild or CISA KEV listing has been identified, but a public researcher writeup with supporting materials exists on GitHub.
Technical ContextAI
dpc.sys is a Windows kernel-mode driver distributed with Thesycon's DPC Latency Checker, a diagnostic utility used to measure deferred procedure call latency on Windows audio systems. The driver exposes an IOCTL interface to user-space applications. IOCTL 0x81772008 reads a pointer value from the user-supplied input buffer and dereferences it directly in kernel context without any ProbeForRead or pointer validation guard, then passes the dereferenced value to ExSetTimerResolution, a Windows kernel API for setting system timer resolution. Because the kernel unconditionally trusts the supplied address, an attacker can provide a pointer to unmapped or invalid memory, causing a kernel-mode access violation (bug check). The root cause is CWE-20 (Improper Input Validation) - specifically, the absence of pointer validation at the kernel IOCTL boundary before passing attacker-controlled data to a sensitive kernel API.
RemediationAI
No vendor-released patched version has been identified in the available data - no fix version or official Thesycon advisory URL was provided. Users running DPC Latency Checker should check the Thesycon website (thesycon.de) for an updated dpc.sys driver release. As a compensating control, uninstalling or disabling the DPC Latency Checker driver entirely eliminates the attack surface; since this is a diagnostic utility rather than a production dependency, removal is the most practical mitigation for most environments. If the tool must remain installed, restricting interactive local logon rights and limiting which users can execute arbitrary binaries reduces the exploitable population. Organizations with Windows endpoint management (e.g., AppLocker, WDAC) can deny execution of the DPC Latency Checker application to prevent the vulnerable IOCTL from being reachable.
Same weakness CWE-20 – Improper Input Validation
View allSame technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today