The vulnerability is a use‑after‑free bug in the Windows WFP callout driver of Akamai Guardicore Platform Agent. It lets a local low‑privileged user craft an outbound ICMPv6 packet that contains an IPv6 Hop‑by‑Hop header. When the IPv6 ICMP redirect policy is enabled, the packet is copied into a buffer that is freed but then passed to a downstream filter. The attacker can control the length of the packet, allowing kernel pool grooming and eventual crash of the system.

Akamai Guardicore Platform Agent running on Windows. The vulnerability has been documented in the changelog for version 7.4 and earlier releases; because the affected versions are not explicitly listed, any installation that matches the product name and includes the Windows WFP caller should be considered potentially vulnerable.

The CVSS score of 4.7 indicates a medium severity vulnerability, and the EPSS score of less than 1 % shows a very low probability of exploitation. The bug requires an attacker to have local, low‑privileged access and to have the non‑default IPv6 ICMP redirect policy enabled on the endpoint. It is not listed in CISA’s KEV catalog, so there is no reported active exploitation of this issue. The fact that the exploit is local and requires a specific policy setting reduces the threat surface compared to remote vulnerabilities, but the impact of a system crash makes it a priority for remediation.