The **group-key handshake issue** ([CVE-2017-13080][1]) has [a Windows security advisory][2], but unsupported OSes like Vista and XP are not listed. Given that this is a protocol-level issue that has been in place for a very long time, my guess is that XP and Vista are also be affected. (It's also important to note both that paid XP support is still theoretically available, and that [the Qualys advisory][3] includes XP Embedded in its detection list for this CVE.)

The impact would therefore be the same as for other platforms - a specific kind of spoofing in which replaying frames *from the access point to the client* is possible. From [the paper][4]:

> When the 4-way or fast BSS transition handshake is attacked, the
> precise impact depends on the data-confidentiality protocol being
> used. If CCMP is used, arbitrary packets can be decrypted. In turn,
> this can be used to decrypt TCP SYN packets, and hijack TCP
> connections. For example, an adversary can inject malicious content
> into unencrypted HTTP connections. If TKIP or GCMP is used, an
> adversary can both decrypt and inject arbitrary packets.

The **fast BSS issue** ([CVE-2017-13082][5]), by contrast, does not appear to have an associated Microsoft security bulletin at all that I could find. I tentatively conclude that no Microsoft products are actually subject to this specific CVE.


  [1]: https://nvd.nist.gov/vuln/detail/CVE-2017-13080
  [2]: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-13080
  [3]: https://www.qualys.com/research/security-alerts/2017-10-10/microsoft/
  [4]: https://papers.mathyvanhoef.com/ccs2017.pdf
  [5]: https://nvd.nist.gov/vuln/detail/CVE-2017-13082