The Thesycon DPC Latency Checker driver (dpc.sys) contains an exposed IOCTL interface that accepts user-provided data without validating pointers; a local unprivileged user can provide a crafted pointer that the driver dereferences before calling ExSetTimerResolution. This results in an arbitrary kernel memory access and causes a Blue Screen of Death, disabling the system. The vulnerability is a classic kernel-mode denial‑of‑service flaw that can be leveraged by any user on the machine.

This issue affects Windows systems running versions of the Thesycon DPC Latency Checker driver up to 1.4.0. No vendor or product name is listed beyond the driver itself. The vulnerability exists specifically in the driver file dpc.sys and its IOCTL implementation.

The flaw is exploitable locally by any user with permissions to invoke the IOCTL, which is typically available without elevated rights. The CVSS score is 5.5, indicating moderate severity, but the impact is severe because it leads to a forced system crash. As it drains kernel memory via pointer dereference, it bypasses user‑mode controls. No evidence of current exploitation exists; the EPSS score is unavailable and the vulnerability is not listed in CISA KEV. Nonetheless, the potential for a local denial‑of‑service attack remains high for affected systems.