CVE-2026-50217 in Guardicore Platform Agent
Summary
by MITRE • 10/14/2026
A use-after-free vulnerability in the Windows WFP callout driver of Akamai Guardicore Platform Agent (GPA) allows a local low-privileged user to cause a denial of service (system crash / BSOD) via an outbound ICMPv6 packet containing an IPv6 Hop-by-Hop extension header. When the IPv6 ICMP redirect policy is active, the packet is copied into a buffer that is freed but subsequently passed to a downstream filter. The size of the freed allocation is attacker-controlled (via packet length), enabling kernel pool grooming. Exploitation requires that the non-default IPv6 ICMP capture/redirect policy is enabled for the endpoint.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 10/14/2026
The vulnerability identified in the Akamai Guardicore Platform Agent involves a critical use-after-free flaw within its Windows Filtering Platform callout driver, specifically affecting how outbound Internet Control Message Protocol version 6 packets are processed when IPv6 Hop-by-Hop extension headers are present. This defect allows an attacker with local low-privileged access to trigger a system crash or blue screen of death by manipulating the lifecycle of kernel memory allocations during network packet filtering operations. The core technical flaw occurs when the endpoint has a non-default IPv6 ICMP capture or redirect policy enabled, which causes incoming packets to be copied into a specific buffer for further inspection and processing. During this process, the driver incorrectly manages the memory associated with these buffers, leading to a scenario where the allocated memory is freed while still being referenced by downstream filter components that continue to access it.
The operational impact of this vulnerability centers on the ability of an attacker to cause a denial of service against the affected system. By crafting malicious outbound ICMPv6 packets containing specific Hop-by-Hop extension headers, a low-privileged user can force the kernel into accessing freed memory regions. This misuse not only results in immediate system instability and crashes but also creates conditions suitable for more sophisticated attacks through kernel pool grooming. The size of the freed allocation is attacker-controlled via packet length parameters, which provides an opportunity to manipulate heap structures within the Windows kernel environment. Such manipulation can potentially lead to arbitrary code execution if combined with other exploitation techniques, although the primary documented impact remains system destabilization and service interruption for critical security infrastructure managed by the Guardicore agent.
From a classification perspective, this vulnerability aligns with CWE-416, which describes use-after-free errors where memory is accessed after it has been freed, leading to undefined behavior that can be exploited for control flow hijacking or denial of service. In terms of tactical mapping within the MITRE ATT&CK framework, this flaw facilitates initial access and privilege escalation pathways by allowing local users to disrupt security controls or potentially gain higher privileges through kernel exploitation techniques such as heap spraying or pool grooming. The requirement for specific policy configurations means that organizations relying on advanced IPv6 ICMP filtering features are particularly susceptible unless mitigations are applied promptly.
Mitigation strategies should focus on disabling the non-default IPv6 ICMP capture and redirect policies if they are not strictly necessary for network operations, thereby removing the trigger condition for this vulnerability. Additionally, applying vendor-provided patches or updates to the Akamai Guardicore Platform Agent is essential to resolve the underlying memory management errors within the WFP callout driver. Security teams should also monitor system logs for signs of kernel-level anomalies and ensure that endpoint detection and response solutions are configured to detect unusual network traffic patterns involving IPv6 Hop-by-Hop headers, which may indicate attempted exploitation activities against this specific flaw in protected environments.