Guardicore Platform Agent EUVD-2026-100833

Exploitation requires ALL of: (1) local access to the Windows endpoint as at least a low-privileged user (AV:L/PR:L); (2) the non-default IPv6 ICMP capture/redirect policy must be explicitly enabled for that endpoint - on default configurations the vulnerable code path is not reached; (3) the attacker must emit an outbound ICMPv6 packet containing an IPv6 Hop-by-Hop extension header, with packet length chosen to control the freed allocation size for kernel pool grooming. Limiting factors that reduce realistic risk: the local-only vector (no remote reachability), the non-default policy prerequisite (deployments without the ICMP redirect policy are unaffected), high attack complexity (pool grooming plus a use-after-free race window), and impact limited to denial of service (BSOD) with no confidentiality or integrity effect.

This is a genuinely low-to-moderate priority issue despite being memory corruption (CWE-416 use-after-free). The provided CVSS 3.1 vector (AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H, base 4.7) is internally consistent and constrains the threat sharply: the attack vector is LOCAL (not network-exploitable despite the packet-based trigger - the malicious ICMPv6 packet must originate from the local endpoint), attack complexity is HIGH (kernel pool grooming plus a race on a freed allocation), and only AVAILABILITY is impacted (C:N/I:N) - the documented outcome is a system crash/BSOD, not code execution or data compromise. No EPSS score, KEV listing, or POC was provided in the input, so there is no evidence of exploitation probability or active abuse; per precision rules this is 'no public exploit identified at time of analysis.' An SSVC-style read is favorable to defenders: exploitation is not observed/active, the technical impact is partial (DoS only), and exploitation is NOT automatable given the local access requirement and the non-default policy prerequisite. The one caveat worth flagging: the description describes an attacker-controlled freed allocation size enabling 'kernel pool grooming,' which is language typically associated with privilege-escalation/RCE research - but the CVSS vector and vendor framing both scope the confirmed impact to DoS (A:H only). Treat any RCE potential as unconfirmed speculation unless the vendor states otherwise; the authoritative signals all point to DoS.

A low-privileged local user on a Windows endpoint running Guardicore Platform Agent - where the non-default IPv6 ICMP capture/redirect policy has been enabled by an administrator - transmits a crafted outbound ICMPv6 packet carrying an IPv6 Hop-by-Hop extension header, sized to groom the kernel pool. The WFP callout driver copies the packet into a buffer, frees it, then passes the stale pointer to a downstream filter, triggering a use-after-free that crashes the kernel (BSOD). No public exploit code was identified, and the high attack complexity (pool grooming plus the race window) makes reliable triggering nontrivial.