Vulnerability · Published Oct 14, 2026 · Assigned by mitre
CVE-2026-50217
Medium 4.7
In plain English
A medium-severity use-after-free in Guardicore Platform Agent from Akamai. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.1% (higher than 1% of all known vulnerabilities).
Official description
A use-after-free vulnerability in the Windows WFP callout driver of Akamai Guardicore Platform Agent (GPA) allows a local low-privileged user to cause a denial of service (system crash / BSOD) via an outbound ICMPv6 packet containing an IPv6 Hop-by-Hop extension header. When the IPv6 ICMP redirect policy is active, the packet is copied into a buffer that is freed but subsequently passed to a downstream filter. The size of the freed allocation is attacker-controlled (via packet length), enabling kernel pool grooming. Exploitation requires that the non-default IPv6 ICMP capture/redirect policy is enabled for the endpoint.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Akamai | Guardicore Platform Agent | 0 – before 7.4 |
Weakness: CWE-416 · Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H