Executive brief
DPC Latency Checker is a Windows driver utility used to measure system latency and performance. A flaw in the driver (dpc.sys) allows any local user without special privileges to send a specially crafted request that crashes the entire Windows system, causing service outages and forcing reboots. The affected vendor no longer supports the software, and no patches are available.
Technical details
The vulnerability is an arbitrary kernel pointer dereference in the IOCTL handler 0x81772008 of dpc.sys. The driver accepts user-supplied input through the DeviceIoControl interface without validating pointers before dereferencing them in a call to ExSetTimerResolution. An unprivileged local attacker can exploit this by opening a handle to the driver device via CreateFile and sending a crafted IOCTL request containing an invalid pointer. The dereference results in arbitrary kernel-mode memory access and triggers a Blue Screen of Death (BSOD), causing a denial of service. No vendor patches are available; the software is no longer maintained or distributed by Thesycon.
Affected products
- Thesycon DPC Latency Checker through 1.4.0
Timeline
- 2026-09-09: disclosed