CVE-2026-50217: Use After Free
A use-after-free vulnerability in the Windows WFP callout driver of Akamai Guardicore Platform Agent (GPA) allows a local low-privileged user to cause a denial of service (system crash / BSOD) via an outbound ICMPv6 packet containing an IPv6 Hop-by-Hop extension header. When the IPv6 ICMP redirect policy is active, the packet is copied into a buffer that is freed but subsequently passed to a downstream filter. The size of the freed allocation is attacker-controlled (via packet length), enabling kernel pool grooming. Exploitation requires that the non-default IPv6 ICMP capture/redirect policy is enabled for the endpoint.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Disable the non-default IPv6 ICMP capture/redirect policy for the endpoint.
Akamai Guardicore Platform Agent (GPA) IPv6 ICMP capture/redirect policy = disabled
Event History
Frequently Asked Questions
Which endpoints are exposed?
Only endpoints where the non-default IPv6 ICMP capture/redirect policy is enabled are exposed. Systems using the default configuration are not affected by the described attack path.
What access and traffic are required to trigger the issue?
An attacker needs local low-privileged access to the endpoint. They must send an outbound ICMPv6 packet containing an IPv6 Hop-by-Hop extension header while the IPv6 ICMP redirect policy is active.
What is the expected impact?
The documented impact is denial of service through a system crash or BSOD. The attacker can control the freed allocation size through packet length, which may allow kernel pool grooming.
What can be done if patching is not immediately possible?
Disable the IPv6 ICMP capture/redirect policy where operationally feasible. That policy must be active for the described vulnerability to be exploitable.