EUVD-2026-100832
GHSA-426c-439h-xj38
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessSend crafted sub-96-byte UDP datagram to DNS proxy
-
ExploitTrigger integer underflow in size computation
-
ImpactUncaught Objective-C exception aborts root system extension
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Integer underflow checks
|
| Exploitation Conditions | Requires the Akamai Guardicore Platform Agent macOS NetworkExtension system extension to be installed and its DNS proxy component active and receiving UDP traffic; the attacker must deliver a single UDP datagram shorter than 96 bytes that begins with a specific trigger value to the proxy. No authentication or user interaction is needed per the CVSS vector (PR:N/UI:N). The key limiting factor is reachability of the DNS-proxy listener: if the proxy only processes on-device queries or upstream DNS responses rather than arbitrary attacker-originated packets, practical exploitation may require local/on-path positioning rather than the fully remote access AV:N implies; impact is also self-limited to a crash of the extension (which the OS may restart) with no code execution or data exposure. |
| Impact | This is a genuine but bounded availability issue, not a top-tier priority. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L, base 5.3 MEDIUM) describes a network-reachable, low-complexity, unauthenticated trigger with no confidentiality or integrity impact and only partial availability impact (A:L) - consistent with the description, where a malformed UDP datagram causes an uncaught Objective-C exception that aborts the DNS-proxy system extension (a crash/DoS, not code execution or data exposure). No EPSS score, CISA KEV listing, POC, or SSVC decision data was provided, so there are no exploitation-probability signals to weigh; exploitation status is therefore 'no public exploit identified at time of analysis.' One signal to verify: the CVSS claims AV:N, but a macOS DNS-proxy NetworkExtension may only process datagrams delivered on-device or as upstream DNS responses, which could make real-world reach adjacent/local rather than fully remote - verify the listener exposure with the vendor. The main impact is that aborting the ROOT system extension can disable the agent's network security/microsegmentation enforcement, which is operationally more significant than a generic app crash; however with no exploitation evidence this remains patch-on-normal-cycle rather than emergency. |
| Exploit ScenarioDerived | An attacker able to deliver UDP traffic to the GPA DNS-proxy listener sends a datagram shorter than 96 bytes beginning with a specific value; a size computation underflows toward SIZE_MAX, the resulting allocation fails, and the uncaught Objective-C exception aborts the root system extension. The net effect is a repeatable denial of service against the Guardicore agent's DNS-proxy/network-protection component. No public exploit code was identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 14, 2026
A malformed UDP packet can abort the DNS proxy running inside the Akamai Guardicore Platform Agent's macOS NetworkExtension system extension, which executes as a root-level system extension, producing an availability loss on the host. Specifically, a single UDP datagram shorter than 96 bytes that begins with a particular trigger value drives an integer underflow (CWE-191) in a length/size calculation, causing a near-SIZE_MAX allocation request that fails and raises an uncaught Objective-C exception, terminating the extension. The CVSS 3.1 vector (5.3, AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) rates this as a low-impact, unauthenticated network availability issue with no confidentiality or integrity effect, and the independent assessment characterises it as a genuine but bounded problem whose real-world reachability depends on whether the DNS proxy listener actually consumes arbitrarily sourced packets or only on-device queries and upstream responses; no public exploit code and no CISA KEV entry were identified at the time of analysis, and no EPSS score was supplied in the source data.
RemediationAI
Patch availability is per the vendor advisory: Akamai's security advisory page for Guardicore Platform Agent 7.4 (https://www.akamai.com/newsroom/security-advisories/guardicore-platform-agent-7-4) together with the changelog at https://techdocs.akamai.com/guardicore-platform-agent/changelog/ is the authoritative source for the fixed release, so the primary action is to upgrade macOS endpoints to the version named in that 7.4 advisory and confirm the extension version reported by the host after upgrade. Where immediate upgrade is not possible, the most direct mitigation is to disable the Guardicore DNS proxy / DNS-based network protection feature on macOS endpoints through the management console, accepting the trade-off that DNS-layer visibility, telemetry and filtering are lost and endpoints fall back to OS resolver behaviour. Because the crash is triggered by inbound UDP to the proxy listener, a host firewall or network ACL restricting which sources may send UDP to that local listening port can reduce exposure, but this risks breaking legitimate upstream DNS resolution and local query handling if applied too broadly, so it must be scoped to the proxy port and validated in a test group first. Note that the impact is bounded because macOS may automatically restart the system extension, so the practical effect is repeated crashes and gaps in DNS telemetry rather than a permanent denial of service; monitoring for repeated extension crash or restart events provides useful early warning of exploitation attempts, and because no public exploit code was identified at the time of analysis, prioritisation can be scheduled rather than emergency-driven for most environments.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The affected code is the DNS proxy built on Apple's NetworkExtension framework, delivered as a root-level system extension within the Akamai Guardicore Platform Agent for macOS. The root cause is CWE-191 (Integer Underflow): a size or length field is computed from the length of the received datagram (less than 96 bytes) minus a fixed header/constant offset, so a valid-looking but undersized packet beginning with a specific trigger byte pattern causes the subtraction to wrap to a value close to SIZE_MAX. That wrapped value is then passed to an allocation routine, which necessarily fails; because the failure path raises an Objective-C exception that is not caught in the extension's packet-processing loop, the process aborts rather than degrading gracefully. The CPE string cpe:2.3:a:akamai:guardicore_platform_agent:*:*:*:*:*:*:*:* uses a wildcard version, indicating the CPE feed does not constrain the affected range, and the referenced Akamai advisory targets the 7.4 release line, implying fixes shipped there. Notably, the source feed tags include 'Information Disclosure' alongside 'Integer Overflow', but the assessed CVSS vector reports C:N/I:N/A:L, so no data exposure is supported by the assessment; the impact is confined to availability. The distinction between AV:N in the vector and the practical exposure matters here, since a DNS proxy typically handles on-device queries and upstream resolver traffic, so an attacker may need on-path or local positioning to inject the trigger datagram even though the vector is scored network-reachable with no privileges or user interaction.
Know when Guardicore Platform Agent gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
A single unauthenticated malformed datagram reliably aborts the extension, so AV:N/AC:L/PR:N/UI:N; impact is a partial availability loss of one component only (A:L), with no C/I effect.
Primary rating from Vendor (mitre).
CVSS VectorVendor: mitre
Lifecycle Timeline
2DescriptionCVE.org
An integer underflow exists in the DNS proxy component of the macOS NetworkExtension system extension shipped with Akamai Guardicore Platform Agent (GPA) for macOS, whereby if a UDP datagram shorter than 96 bytes that begins with a specific value is received, a subsequent size computation underflows to a near-SIZE_MAX value, causing an allocation failure and uncaught Objective-C exception that aborts the root system extension.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Integer overflow occurs when an arithmetic operation produces a result that exceeds the maximum value a given integer type can store.
More in Guardicore Platform Agent
View allImproper validation of the JWT seeding token used by Akamai's Guardicore Platform Agent (GPA) client before version 7.4
Local privilege escalation in Akamai Guardicore Platform Agent (GPA) on macOS before version 7.4 allows an attacker with
Local, low-privileged users can cause a denial-of-service (BSOD) on Windows endpoints running Akamai Guardicore Platform
Exploit-DB