Double free in Windows IKE Extension

CVE-2026-33824 is a double-free memory corruption vulnerability in ikeext.dll, the Windows IKE Extension responsible for IKEv2 negotiation used by IPsec VPNs, Always On VPN, DirectAccess, and site-to-site tunnels. During IKEv2 fragment reassembly, IkeReinjectReassembledPacket() performs a shallow copy of a heap-allocated blob pointer. When the work item is destroyed via IkeDestroyPacketContext, the allocation is freed once; it is freed again when the MMSA is cleaned up through IkeCleanupMMNegotiation. An unauthenticated attacker triggers this by sending a crafted IKE_SA_INIT (with Microsoft Security Realm Vendor ID) followed by fragmented IKE_AUTH payloads to UDP port 500 or 4500. All supported Windows 10 (1607+), Windows 11, and Windows Server 2016–2025 are affected. The April 2026 Patch Tuesday updates fix the issue.

Microsoft's CRITICAL / 9.8 rating is accurate and, if anything, undersells the operational urgency. The CVSS vector — AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H — perfectly describes the attack: zero auth, zero interaction, low complexity, full impact. ZDI explicitly flagged this as wormable. CISA added it to the KEV catalog, EPSS sits at the 55th percentile (0.5585), and a public PoC (EpSiLoNPoInTIkEv2.cpp) has been circulating since at least mid-2026. There is no friction to discount here — this is the real deal.

Why this verdict

• Zero friction in the kill chain: The attack is unauthenticated, requires no user interaction, uses low-complexity network packets to UDP 500/4500. There are no prerequisite compromises — the attacker goes from internet to SYSTEM in a single chain.
• Role multiplier: The affected component (IKEEXT/IKEv2) is canonically deployed on network-edge VPN gateways (RRAS, Always On VPN, DirectAccess) — these are internet-facing by definition. On domain controllers running IPsec transport-mode policies, exploitation yields immediate DA-equivalent access. On Hyper-V hosts using IPsec for live migration, compromise equals hypervisor takeover. ≥10% of Windows Server IKEEXT installations occupy a high-value network-edge or DC role. The blast radius is fleet-scale via worm propagation. Verdict floor: CRITICAL.
• Wormable + KEV + public PoC: ZDI explicitly labeled this wormable. CISA KEV-listed it. A working PoC (EpSiLoNPoInTIkEv2.cpp) is public. EPSS at 0.5585 confirms high exploitation probability. This combination eliminates any theoretical-only discount.
• Universal affected population: Every supported Windows version (10, 11, Server 2016–2025) ships with ikeext.dll. The service starts on demand when any IPsec or VPN policy is configured — which is standard for enterprise networks.

Why not higher?

The CVSS 9.8 is already the practical ceiling for a Scope:Unchanged vulnerability. A 10.0 would require Scope:Changed. The vendor score is the maximum applicable score and there is no basis to exceed it.

Why not lower?

Downgrading would require identifying meaningful friction or a narrow affected population — neither exists here. The attack is unauthenticated and network-level, the affected component is a canonical network-edge service, the bug is wormable, it is KEV-listed with active exploitation, and a public PoC is available. Any single one of these factors would anchor the verdict at HIGH; together they cement CRITICAL. The role multiplier floor alone (network-edge VPN appliance, domain controllers with IPsec) prevents any downgrade below CRITICAL.

1. Block UDP 500 and 4500 from untrusted sources at the perimeter firewall immediately — The exploit requires sending crafted IKE packets to these ports. Restrict inbound UDP 500/4500 to an explicit allowlist of known VPN peer IP addresses. This eliminates the unauthenticated internet attack vector. Deploy within the noisgate mitigation SLA of ≤ 3 days for CRITICAL findings.
2. Set IKEEXT service to Disabled on hosts not using IPsec or VPN — Many Windows workstations and servers have IKEEXT in demand-start mode but never actually use IPsec. Disabling the service via GPO (sc config IKEEXT start= disabled) eliminates the attack surface entirely on those hosts. Audit which hosts actually need IKE before disabling. Deploy within 3 days.
3. Deploy IDS/IPS signatures for CVE-2026-33824 — Snort/Suricata rules from Talos and ET Open cover malformed IKE_SA_INIT and SKF fragment sequences. Deploy these on perimeter and internal NDR sensors to detect exploitation attempts and worm propagation. Enable in blocking mode on inline IPS where possible.
4. Enable host-based firewall rules blocking inter-host UDP 500/4500 — To prevent internal worm propagation, deploy Windows Firewall rules via GPO that restrict UDP 500/4500 to only the designated VPN gateway IPs. This breaks the worm's lateral movement path even if one host is compromised.
5. Apply April 2026 cumulative updates to all affected systems — This is the definitive fix. Prioritize VPN gateways, RRAS servers, domain controllers, and Hyper-V hosts. Use the noisgate remediation SLA of ≤ 90 days, but given KEV status, target internet-facing systems within hours to days.

Run this script on each target Windows host as Administrator. It checks whether the IKEEXT service is present and running, and whether the installed OS build includes the April 2026 fix. Example: powershell -ExecutionPolicy Bypass -File .\Check-CVE-2026-33824.ps1. Requires local admin privileges.

#Requires -RunAsAdministrator
<# Check-CVE-2026-33824.ps1
   Checks whether the host is vulnerable to CVE-2026-33824 (Windows IKE Double Free)
   Outputs: VULNERABLE / PATCHED / UNKNOWN
#>

$ErrorActionPreference = 'Stop'

# Patched KB list (April 2026 cumulative updates)
$patchedKBs = @('KB5082200','KB5083769','KB5082052','KB5082063','KB5082123','KB5082198')

# Check if IKEEXT service exists and its status
try {
    $svc = Get-Service -Name 'IKEEXT' -ErrorAction Stop
    $svcStatus = $svc.Status
    $svcStart = $svc.StartType
} catch {
    Write-Host '[*] IKEEXT service not found on this host.'
    Write-Host 'UNKNOWN - IKEEXT service absent; host may be non-standard build.'
    exit 2
}

Write-Host "[*] IKEEXT service found: Status=$svcStatus, StartType=$svcStart"

# Check installed hotfixes for patched KBs
$installedKBs = Get-HotFix | Select-Object -ExpandProperty HotFixID
$matched = $patchedKBs | Where-Object { $installedKBs -contains $_ }

if ($matched.Count -gt 0) {
    Write-Host "[+] Patched KB detected: $($matched -join ', ')"
    Write-Host 'PATCHED'
    exit 0
}

# Fallback: check OS build number (April 2026 builds)
$osBuild = [System.Environment]::OSVersion.Version
$buildRevision = (Get-ItemProperty 'HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion').UBR
$buildStr = "$($osBuild.Build).$buildRevision"
Write-Host "[*] OS Build: $buildStr"

# Known patched build thresholds (build.revision)
$patchedBuilds = @{
    '19045' = 7184   # Win10 22H2
    '22631' = 6936   # Win11 23H2
    '26100' = 8246   # Win11 24H2 / Server 2025
    '26200' = 8246   # Win11 25H2
}

$buildKey = $osBuild.Build.ToString()
if ($patchedBuilds.ContainsKey($buildKey)) {
    if ($buildRevision -ge $patchedBuilds[$buildKey]) {
        Write-Host "[+] OS build revision $buildRevision >= patched threshold $($patchedBuilds[$buildKey])"
        Write-Host 'PATCHED'
        exit 0
    } else {
        Write-Host "[-] OS build revision $buildRevision < patched threshold $($patchedBuilds[$buildKey])"
    }
}

# If IKEEXT exists and no patch detected
if ($svcStart -eq 'Disabled') {
    Write-Host '[!] IKEEXT service is Disabled — attack surface removed but host is unpatched.'
    Write-Host 'VULNERABLE (mitigated - service disabled)'
    exit 1
}

Write-Host '[-] No patched KB or build revision found. IKEEXT service is present and not disabled.'
Write-Host 'VULNERABLE'
exit 1

Sources

1. ZDI Technical Analysis — CVE-2026-33824 IKEv2 RCE
2. Security Boulevard — Windows IKE RCE Advisory
3. Integrity360 Threat Advisory — CVE-2026-33824
4. CrowdStrike April 2026 Patch Tuesday Analysis
5. CISA Known Exploited Vulnerabilities Catalog
6. Tenable — April 2026 Patch Tuesday (163 CVEs)
7. SentinelOne Vulnerability Database — CVE-2026-33824