Unauthenticated code execution via IKEv2 fragment double-free
Published Apr 14, 2026 · Updated Apr 14, 2026
Double free in Microsoft Windows IKE Extension allows remote attackers to execute arbitrary code through crafted IKEv2 packets. During fragment reassembly, IkeQueueRecvRequest shallow-copies a Security Realm blob pointer, so packet-context and association cleanup free the same allocation. Exploitation requires an IKE_SA_INIT request with the Security Realm Vendor ID followed by fragmented invalid IKE_AUTH traffic, granting SYSTEM-context execution or crashing IKEEXT.
Summary
What happened
Double free in Microsoft Windows IKE Extension allows remote attackers to execute arbitrary code through crafted IKEv2 packets. During fragment reassembly, IkeQueueRecvRequest shallow-copies a Security Realm blob pointer, so packet-context and association cleanup free the same allocation. Exploitation requires an IKE_SA_INIT request with the Security Realm Vendor ID followed by fragmented invalid IKE_AUTH traffic, granting SYSTEM-context execution or crashing IKEEXT.
The record
- CVE
- CVE-2026-33824
- Published
- Apr 14, 2026
- Updated
- Apr 14, 2026
- Vendor
- Microsoft
- Product
- Windows Server 2019
- Classifications
- CWE-415, T1210
- Attack vector
- network
- Privileges
- unauthenticated
Timeline
How it unfolded
- Apr 14, 2026CVE publishedPublication date reported by the CVE source.
- Apr 14, 2026Record updatedLatest update available in the CVE record.
- Aug 18, 2026Exploitation reportedCISA Known Exploited Vulnerabilities listing
Exploitability
Present is not the same as exploitable
Compare your product and version with the public record. A matching version still requires validation against your environment.
Is a vulnerable build present?
Compare these published version ranges with your installed build and any vendor patches.
- Affected versionversion=10.0.17763.0 <10.0.17763.8644
What conditions does exploitation require?
What is affected?
Published CVSS scores
CVSS describes severity. EPSS estimates exploitation probability.
Attacks
What attackers are doing with it
Daily unique IPs observed by Shadowserver honeypots for known exploited vulnerabilities (KEVs). Missing observations do not establish an absence of attacks.
Public exploit references
- IKEV2-POCproof of concept · unverified
Labels summarize the accepted research assessment. They do not indicate a test against your environment.
Reported exploitation
- Chinese-speaking actor IKE VPN exploitationthreat actor
- CISA Known Exploited Vulnerabilities listingknown exploited catalog
Technologies
Your stack
See the directory against your own environment.
Your stack
Check the software in your environment
Book a demo to see how Hinoki identifies affected software and validates exploitability in your environment.
Book a demo