CVE-2026-50215 in Guardicore Platform Agent
Summary
by MITRE • 10/15/2026
A use-after-free exists in the Windows WFP packet-capture driver shipped with Akamai Guardicore Platform Agent (GPA) before 7.4. When an IPv6 proxy/redirect rule is active, a local attacker with Administrator privileges can send a single crafted outbound IPv6 packet via a raw IPV6_HDRINCL socket to trigger this at DISPATCH_LEVEL, resulting in an immediate system crash.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 10/15/2026
The vulnerability identified involves a critical use-after-free condition within the Windows Filtering Platform (WFP) packet-capture driver associated with Akamai Guardicore Platform Agent versions prior to 7.4. This flaw is situated deep within the kernel-mode execution environment, specifically triggering at DISPATCH_LEVEL, which indicates that the code executes in an interrupt context where thread switching is disabled and certain synchronization primitives are restricted or unavailable. The root cause of this instability lies in improper memory management practices by the driver developer, wherein a pointer to a previously freed memory block remains accessible and subsequently dereferenced after the underlying object has been deallocated. This class of defect corresponds directly with CWE-416, Use After Free, which is widely recognized as one of the most dangerous software vulnerabilities due to its potential for arbitrary code execution or system instability depending on how the stale pointer is utilized by the operating system kernel.
The operational mechanics of this exploit require a local attacker who possesses Administrator privileges, reflecting the high privilege level necessary to interact with low-level network drivers and raw sockets in Windows environments. The attack vector involves configuring an IPv6 proxy or redirect rule within the Guardicore platform agent configuration, which activates specific packet processing paths that are susceptible to race conditions or logic errors during memory lifecycle management. Once this condition is established, the attacker sends a single crafted outbound IPv6 packet through a raw IPV6_HDRINCL socket. The use of IPV6_HDRINCL allows the application to construct its own IP headers, providing precise control over packet structure and potentially influencing how the driver processes or frees associated data structures during capture operations.
The immediate consequence of triggering this vulnerability is an instantaneous system crash, typically manifesting as a Blue Screen of Death (BSOD) with bug checks related to invalid memory access such as PAGE_FAULT_IN_NONPAGED_AREA or similar kernel-mode exceptions. Because the flaw occurs at DISPATCH_LEVEL, standard exception handling mechanisms may be limited in their ability to gracefully recover from the error without compromising system integrity. This results in a complete denial of service for all processes running on the affected host, disrupting business operations and potentially causing data loss if unsaved work is present on the machine. From an offensive security perspective, while this specific instance primarily demonstrates reliability issues leading to availability impact, use-after-free vulnerabilities are frequently chained with other techniques to achieve arbitrary code execution, making them a high-priority target in advanced persistent threat scenarios.
In terms of industry classification and mapping, this vulnerability aligns with MITRE ATT&CK technique T1055, Process Injection, or more broadly T1203, Exploitation for Defense Evasion, depending on the ultimate intent if code execution were achieved through further exploitation steps. However, given the current manifestation as a crash, it primarily impacts availability and falls under the broader category of kernel-level exploits that bypass user-mode security boundaries. The presence of such flaws in network filtering agents highlights the risks associated with third-party kernel drivers that operate at Ring 0, where mistakes can have catastrophic consequences for system stability.
Mitigation strategies must focus on immediate remediation through vendor updates and rigorous configuration management. Organizations running Akamai Guardicore Platform Agent versions earlier than 7.4 should prioritize upgrading to a patched version as soon as possible to eliminate the underlying memory corruption flaw. In environments where patching is not immediately feasible, administrators should consider disabling IPv6 proxy or redirect rules if they are not strictly required for network segmentation policies, thereby removing the specific trigger condition from the attack surface. Additionally, enforcing strict least-privilege principles can help mitigate risk by ensuring that only authorized personnel have Administrator access to systems running vulnerable agent versions, although this is often challenging in enterprise environments where administrative rights are widely distributed. Regular auditing of installed kernel drivers and monitoring for unusual system crashes or event log entries related to WFP operations can also aid in early detection of exploitation attempts or residual instability caused by the vulnerability.