CVE-2026-50216: Integer Underflow
An integer underflow exists in the DNS proxy component of the macOS NetworkExtension system extension shipped with Akamai Guardicore Platform Agent (GPA) for macOS, whereby if a UDP datagram shorter than 96 bytes that begins with a specific value is received, a subsequent size computation underflows to a near-SIZEMAX value, causing an allocation failure and uncaught Objective-C exception that aborts the root system extension.
Affected Software
Event History
Frequently Asked Questions
Who can trigger the issue?
An unauthenticated network attacker who can send UDP datagrams to the affected macOS system can trigger it. The crafted datagram must be shorter than 96 bytes and begin with the specific value required to reach the vulnerable size computation.
What is the practical impact of successful exploitation?
Successful triggering causes an allocation failure and an uncaught Objective-C exception, aborting the root macOS NetworkExtension system extension. The reported impact is denial of service; no confidentiality or integrity impact is stated.
How can I tell whether an event may be related to this vulnerability?
Look for unexpected termination or aborts of the GPA macOS NetworkExtension system extension, particularly following receipt of short UDP datagrams. The available data does not provide specific log messages, process names, or detection signatures.