CVE-2025-51619: Thesycon DPC Latency Checker DOS Vulnerability

CVE-2025-51619 Overview

CVE-2025-51619 is a driver vulnerability in the Thesycon DPC Latency Checker driver (dpc.sys) through version 1.4.0. The driver exposes an IOCTL interface at code 0x81772008 that accepts user-controlled input without validating pointers before passing them to kernel APIs. A local, unprivileged user can send a crafted IOCTL request that causes the driver to dereference a user-supplied pointer and pass the resulting value to ExSetTimerResolution. This produces an arbitrary kernel memory access and triggers a system crash (Bug Check / BSOD).

Critical Impact
Any local user can trigger a full Windows system crash by issuing a single IOCTL to the vulnerable driver, resulting in denial of service on affected hosts.

Affected Products

Thesycon DPC Latency Checker driver dpc.sys versions through 1.4.0
Windows systems where the vulnerable driver is installed and loaded
Environments using DPC Latency Checker for audio/real-time latency diagnostics

Discovery Timeline

2026-09-09 - CVE-2025-51619 published to the National Vulnerability Database (NVD)
2026-09-09 - Last updated in NVD database

Technical Details for CVE-2025-51619

Vulnerability Analysis

The flaw is an improper input validation issue [CWE-20] in a Windows kernel-mode driver. dpc.sys registers a device object that accepts I/O Control (IOCTL) requests from user mode. When it receives IOCTL code 0x81772008, the driver reads a pointer supplied by the caller and dereferences it inside kernel context without verifying that the pointer references valid, user-mode memory.

The dereferenced value is then passed to ExSetTimerResolution, a documented kernel API for adjusting system timer resolution. Because the driver never invokes ProbeForRead, ProbeForWrite, or an equivalent check on the incoming buffer, a caller can supply an arbitrary kernel address. The subsequent memory access from ring 0 causes an unrecoverable Bug Check and forces the system to bugcheck (BSOD).

Exploitation requires only local access and low privileges. The impact is limited to availability; confidentiality and integrity are not directly affected. However, the primitive (unchecked kernel pointer dereference) may be a useful building block for further research into kernel information disclosure or privilege escalation on vulnerable installations.

Root Cause

The root cause is the absence of pointer validation on user-supplied IOCTL input. The driver trusts the caller-provided buffer contents and passes them into a kernel API that expects a valid, driver-controlled value. This pattern violates the standard Windows driver requirement to validate all data crossing the user/kernel boundary.

Attack Vector

A local, authenticated user opens a handle to the dpc.sys device object using CreateFileW and issues DeviceIoControl with IOCTL code 0x81772008. The input buffer contains a pointer chosen by the attacker. When the driver dereferences that pointer, the kernel accesses invalid memory and bugchecks the machine. No network access, user interaction, or elevated privileges are required.

// Example exploitation code (sanitized)
// No verified public proof-of-concept code is reproduced here.
// See the referenced GitHub repository for technical details:
// https://github.com/3a1/Vulns/tree/main/CVE-2025-51619

Detection Methods for CVE-2025-51619

Indicators of Compromise

Presence of dpc.sys version 1.4.0 or earlier registered as a kernel service on Windows endpoints.
Unexpected Windows Bug Check events (for example IRQL_NOT_LESS_OR_EQUAL or KMODE_EXCEPTION_NOT_HANDLED) with dpc.sys in the crash stack.
Non-administrative processes opening handles to the DPC Latency Checker device object followed by DeviceIoControl calls using code 0x81772008.

Detection Strategies

Inventory endpoints for the presence and version of dpc.sys using EDR software inventory or PowerShell (Get-WindowsDriver, driverquery).
Correlate Windows crash telemetry (WER, MEMORY.DMP, Event ID 1001) with the loaded driver list to identify crashes involving the vulnerable driver.
Hunt for unusual DeviceIoControl activity from unprivileged processes targeting the DPC Latency Checker device.

Monitoring Recommendations

Alert on repeated system bugchecks across multiple hosts that share the same driver version, as this pattern may indicate active exploitation attempts.
Monitor for installation of dpc.sys on production endpoints where the diagnostic tool is not authorized.
Track process creation events for unsigned or unexpected binaries that open handles to the driver's device path.

How to Mitigate CVE-2025-51619

Immediate Actions Required

Remove the DPC Latency Checker utility and unload dpc.sys from production systems where it is not required for diagnostics.
Restrict local logon and reduce the population of low-privilege users on hosts where the driver must remain installed.
Add the vulnerable driver hash to the Microsoft Vulnerable Driver Blocklist and enable Hypervisor-protected Code Integrity (HVCI) where feasible.

Patch Information

No vendor patch has been referenced in the NVD entry at the time of publication. Consult the GitHub PoC Repository for the latest technical details and monitor Thesycon communications for a fixed release of DPC Latency Checker beyond version 1.4.0.

Workarounds

Uninstall DPC Latency Checker and delete the dpc.sys driver file from %SystemRoot%\System32\drivers\ on affected endpoints.
Disable the driver service using sc.exe config dpc start= disabled followed by a reboot to prevent it from loading.
Enforce Windows Defender Application Control (WDAC) policies that block loading of the vulnerable driver version by hash.

bash

# Configuration example
# Query for the driver and disable/remove it (run as Administrator)
driverquery /v | findstr /i dpc
sc.exe stop dpc
sc.exe delete dpc
del /f %SystemRoot%\System32\drivers\dpc.sys