CVE-2026-33824

Name of the Vulnerable Software and Affected Versions Windows 10 Windows 11 Windows Server versions 2012 through 2025

Description A double-free memory corruption flaw exists in the Windows Internet Key Exchange (IKE) Service Extensions. This issue occurs when the service processes malformed vendor-extension attributes during security association negotiation, leading to a synchronization failure in the cleanup logic that attempts to free the same memory buffer twice. An unauthenticated remote attacker can exploit this by sending specially crafted IKEv2 negotiation packets to UDP ports 500 or 4500. Successful exploitation allows the attacker to overwrite kernel function pointers and execute arbitrary code with SYSTEM privileges without requiring user interaction. This flaw is wormable and has been actively exploited in the wild by automated scanning botnets to bypass VPN gateways and enterprise perimeters, with reported reverse-shell attempts against IKE VPN endpoints.

Recommendations Apply the April 2026 Microsoft Patch Tuesday cumulative security updates for Windows 10, 11, and Server (2012–2025). As a temporary workaround, disable the IKEEXT (IKE and AuthIP IPsec Keying Modules) service. Restrict inbound traffic on UDP ports 500 and 4500 to known, trusted peer IP addresses.