CVE-2026-50215: Use After Free
A use-after-free exists in the Windows WFP packet-capture driver shipped with Akamai Guardicore Platform Agent (GPA) before 7.4. When an IPv6 proxy/redirect rule is active, a local attacker with Administrator privileges can send a single crafted outbound IPv6 packet via a raw IPV6HDRINCL socket to trigger this at DISPATCHLEVEL, resulting in an immediate system crash.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Akamai Guardicore Platform Agent (GPA)to a version that resolves this vulnerability.Fixed in 7.4
Event History
Frequently Asked Questions
Who is exposed to this issue?
Systems running Akamai Guardicore Platform Agent versions before 7.4 are exposed if an IPv6 proxy or redirect rule is active. Exploitation requires a local attacker with Administrator privileges.
What must an attacker be able to do to trigger the crash?
The attacker must be able to send a single crafted outbound IPv6 packet using a raw IPV6_HDRINCL socket. The vulnerable condition is triggered in the WFP packet-capture driver at DISPATCH_LEVEL.
What is the expected impact of successful exploitation?
Successful exploitation causes an immediate system crash. The provided information does not state that code execution, privilege escalation, or data exposure is possible.
How can I determine whether a host is affected?
Check whether the host runs GPA before version 7.4 and whether an IPv6 proxy or redirect rule is active. Both conditions are identified as relevant to triggering the vulnerability.