CVE-2025-51619 Null dereference in n/a
Local unprivileged users can crash Windows systems via a kernel driver that fails to validate user-supplied pointers before dereferencing them.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2025-51619?
CVE-2025-51619 is a medium-severity vulnerability in n/a, published on 9 Sep 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
A vulnerability in the Thesycon DPC Latency Checker driver (dpc.sys) thru 1.4.0 allows local unprivileged users to cause a denial-of-service (BSOD) condition on Windows systems. The driver exposes an IOCTL interface (0x81772008) that accepts user-controlled input without validating pointers before passing them to kernel APIs. Specifically, it dereferences a user-supplied pointer and uses the resulting value in a call to ExSetTimerResolution, leading to an arbitrary kernel memory access. Exploiting this flaw results in a system crash.
Weakness: CWE-20
Which versions are affected by CVE-2025-51619?
How do I fix CVE-2025-51619?
No fix has been published for CVE-2025-51619 yet. Limit exposure of the affected software until one is available.
Is CVE-2025-51619 being exploited?
There is no known exploitation of CVE-2025-51619 in the wild and no public exploit code.
Sources
Also known as GHSA-266q-5v9w-4g37.