The group-key handshake issue (CVE-2017-13080) has a Windows security advisory, but unsupported OSes like Vista and XP are not listed. Given that this is a protocol-level issue that has been in place for a very long time, my guess is that XP and Vista are also be affected. (It's also important to note both that paid XP support is still theoretically available, and that the Qualys advisory includes XP Embedded in its detection list for this CVE.)
The impact would therefore be the same as for other platforms - a specific kind of spoofing in which replaying frames from the access point to the client is possible. From the paper:
When the 4-way or fast BSS transition handshake is attacked, the precise impact depends on the data-confidentiality protocol being used. If CCMP is used, arbitrary packets can be decrypted. In turn, this can be used to decrypt TCP SYN packets, and hijack TCP connections. For example, an adversary can inject malicious content into unencrypted HTTP connections. If TKIP or GCMP is used, an adversary can both decrypt and inject arbitrary packets.
The fast BSS issue (CVE-2017-13082), by contrast, does not appear to have an associated Microsoft security bulletin at all that I could find. I tentatively conclude that no Microsoft products are actually subject to this specific CVE.