The vulnerability is an integer underflow in the DNS proxy component of the macOS NetworkExtension system extension shipped with Akamai Guardicore Platform Agent. When the agent receives a UDP datagram shorter than 96 bytes that begins with a specific value, a size calculation underflows to a value near SIZE_MAX. This causes an allocation failure and an uncaught Objective‑C exception that aborts the root system extension, leading to a denial of service for the GPA functionality and a potential stability issue on the host. The weakness is classified as CWE‑191, representing an unsigned integer underflow.

The flaw affects all installations of Akamai Guardicore Platform Agent for macOS that include the vulnerable DNS proxy component. The advisory does not specify an exact version, so any GPA deployment running the NetworkExtension DNS proxy should be assessed for presence of the issue. There is no additional information indicating that specific release numbers are excluded.

The CVSS score of 5.3 indicates a medium severity vulnerability, while the EPSS score of less than 1% implies a very low probability of commercial exploitation at present. The flaw is not listed in the CISA KEV catalog. Attackers would need to be able to send a specially crafted UDP packet that is shorter than 96 bytes and starts with the predetermined value to trigger the underflow. This requirement is inferred from the description and does not rely on any authentication; however, it usually would require proximity to the target machine or an open UDP listening port on the system extension. The impact is limited to service disruption of the GPA agent and does not directly compromise confidentiality or integrity, resulting in a low to moderate overall risk if the agent is widely deployed.