Description

A vulnerability in the Thesycon DPC Latency Checker driver (dpc.sys) thru 1.4.0 allows local unprivileged users to cause a denial-of-service (BSOD) condition on Windows systems. The driver exposes an IOCTL interface (0x81772008) that accepts user-controlled input without validating pointers before passing them to kernel APIs. Specifically, it dereferences a user-supplied pointer and uses the resulting value in a call to ExSetTimerResolution, leading to an arbitrary kernel memory access. Exploiting this flaw results in a system crash.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.5",
  "pubDate": "2026-09-09T19:17:26.563Z",
  "pubdate": "2026-09-09T19:17:26.563Z",
  "executiveSummary": "The Thesycon DPC Latency Checker driver (dpc.sys) version 1.4.0 and earlier contains a critical vulnerability stemming from improper input validation within its IOCTL interface.\nThe vulnerability is classified as an arbitrary kernel memory access flaw, which allows a local unprivileged attacker to trigger a system-wide denial-of-service (DoS) condition, resulting in a Bug Check (BSOD).\nThe root cause lies in the driver's failure to sanitize user-supplied pointers provided via the IOCTL 0x81772008 interface before passing them to kernel-mode functions.\nSuccessful exploitation requires local access to the system. No specific authentication is required beyond the ability to interact with the device driver.\nThe risk implication is high for environments where system uptime and stability are critical, as an unprivileged user can intentionally crash the kernel.\nThere are no requirements for specialized elevated privileges, making this an accessible target for malicious actors or malware residing on a compromised local workstation.",
  "technicalDetails": "The vulnerability exists within the dpc.sys driver component, specifically in the handler responsible for processing IOCTL 0x81772008.\nThe driver exposes a communication channel that permits user-mode applications to interact with kernel-mode memory through a dispatch routine.\nDuring the processing of the IOCTL 0x81772008 request, the driver accepts a buffer from the user-mode application that contains a pointer intended for system-wide configuration.\nThe driver fails to perform necessary boundary checks or pointer validation (such as ensuring the pointer resides in user-space or is null) before passing the user-supplied value to the kernel API ExSetTimerResolution.\nThe vulnerability manifests as an arbitrary kernel memory dereference. When the malicious pointer is passed, the kernel attempts to read or write memory at the address specified by the user-controlled input.\nBecause ExSetTimerResolution expects valid input and the driver facilitates an unvalidated dereference, the kernel enters an unstable state upon accessing memory locations outside the intended operational context.\nExploitation flow involves the following steps: 1) The attacker opens a handle to the device object associated with dpc.sys using CreateFile. 2) The attacker crafts a malicious input buffer containing an arbitrary memory address. 3) The attacker initiates an IOCTL call via DeviceIoControl with code 0x81772008. 4) The driver receives the buffer and passes the attacker's supplied pointer directly to ExSetTimerResolution. 5) The kernel dereferences the pointer, causing a memory access violation and triggering a bug check, resulting in a system crash.\nThis vulnerability is limited to local exploitation, as it requires the ability to communicate with the driver directly. However, it circumvents standard Windows access controls, as any local user account possesses the capability to open a handle to this driver and trigger the crash condition.\nPost-exploitation impact is limited to a system crash; however, if the attacker were to manipulate the pointer to point to controlled memory, they might theoretically achieve more complex exploitation primitives, although the primary documented outcome is a denial-of-service."
}