CVE-2026-50217

Awaiting Analysis Awaiting Analysis - Queue

Use-After-Free in Akamai Guardicore Platform Agent Windows WFP Driver

Publication date: 2026-10-14

Last updated on: 2026-10-16

Assigner: MITRE

Description

A use-after-free vulnerability in the Windows WFP callout driver of Akamai Guardicore Platform Agent (GPA) allows a local low-privileged user to cause a denial of service (system crash / BSOD) via an outbound ICMPv6 packet containing an IPv6 Hop-by-Hop extension header. When the IPv6 ICMP redirect policy is active, the packet is copied into a buffer that is freed but subsequently passed to a downstream filter. The size of the freed allocation is attacker-controlled (via packet length), enabling kernel pool grooming. Exploitation requires that the non-default IPv6 ICMP capture/redirect policy is enabled for the endpoint.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-14

Last Modified

2026-10-16

Generated

2026-10-19

AI Q&A

2026-10-14

EPSS Evaluated

2026-10-18

NVD

CVE-2026-50217

EUVD

EUVD-2026-100833

Affected Vendors & Products

Vendor	Product	Version / Range
Akamai	Guardicore	Platform Agent 0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-416	The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.

Attack-Flow Graph

Executive Summary

This is a use-after-free vulnerability in the Windows WFP callout driver of Akamai Guardicore Platform Agent. It allows a local low-privileged user to cause a system crash or BSOD by sending a specially crafted outbound ICMPv6 packet with an IPv6 Hop-by-Hop extension header. The vulnerability occurs when the IPv6 ICMP redirect policy is active, causing the packet to be copied into a buffer that is freed but later passed to a downstream filter. The attacker controls the size of the freed allocation via packet length, enabling kernel pool grooming.

Detection Guidance

Detection requires checking if the IPv6 ICMP capture/redirect policy is enabled on Windows endpoints. Use PowerShell: Get-NetIPv6Protocol -PolicyStore ActiveStore | Select-Object SettingName, SettingValue. If the ICMPv6 redirect policy is active, the system may be vulnerable.

Impact Analysis

This vulnerability can cause a denial of service by crashing the system, leading to a BSOD. It requires local low-privileged access and the non-default IPv6 ICMP capture/redirect policy to be enabled. Exploitation could disrupt system operations but does not directly lead to data breaches or privilege escalation.

Compliance Impact

This vulnerability causes a denial of service via system crash, which could disrupt critical services handling sensitive data. For GDPR, this may impact availability of personal data processing systems. For HIPAA, it could affect the integrity and availability of protected health information systems. However, the provided context does not specify direct compliance impacts or data exposure risks.

Mitigation Strategies

Disable the non-default IPv6 ICMP capture/redirect policy on affected endpoints to prevent exploitation. Ensure the Akamai Guardicore Platform Agent is updated to the latest version that addresses this issue.

Hi! I’m here to help you understand CVE-2026-50217. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70