Windows IKE Extension IKEv2 Fragment Reassembly Double-Free Remote Code Execution

#Requires -RunAsAdministrator
<# Check-CVE-2026-33824.ps1
   Checks whether the host is vulnerable to CVE-2026-33824 (Windows IKE Double Free)
   Outputs: VULNERABLE / PATCHED / UNKNOWN
#>

$ErrorActionPreference = 'Stop'

# Patched KB list (April 2026 cumulative updates)
$patchedKBs = @('KB5082200','KB5083769','KB5082052','KB5082063','KB5082123','KB5082198')

# Check if IKEEXT service exists and its status
try {
    $svc = Get-Service -Name 'IKEEXT' -ErrorAction Stop
    $svcStatus = $svc.Status
    $svcStart = $svc.StartType
} catch {
    Write-Host '[*] IKEEXT service not found on this host.'
    Write-Host 'UNKNOWN - IKEEXT service absent; host may be non-standard build.'
    exit 2
}

Write-Host "[*] IKEEXT service found: Status=$svcStatus, StartType=$svcStart"

# Check installed hotfixes for patched KBs
$installedKBs = Get-HotFix | Select-Object -ExpandProperty HotFixID
$matched = $patchedKBs | Where-Object { $installedKBs -contains $_ }

if ($matched.Count -gt 0) {
    Write-Host "[+] Patched KB detected: $($matched -join ', ')"
    Write-Host 'PATCHED'
    exit 0
}

# Fallback: check OS build number (April 2026 builds)
$osBuild = [System.Environment]::OSVersion.Version
$buildRevision = (Get-ItemProperty 'HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion').UBR
$buildStr = "$($osBuild.Build).$buildRevision"
Write-Host "[*] OS Build: $buildStr"

# Known patched build thresholds (build.revision)
$patchedBuilds = @{
    '19045' = 7184   # Win10 22H2
    '22631' = 6936   # Win11 23H2
    '26100' = 8246   # Win11 24H2 / Server 2025
    '26200' = 8246   # Win11 25H2
}

$buildKey = $osBuild.Build.ToString()
if ($patchedBuilds.ContainsKey($buildKey)) {
    if ($buildRevision -ge $patchedBuilds[$buildKey]) {
        Write-Host "[+] OS build revision $buildRevision >= patched threshold $($patchedBuilds[$buildKey])"
        Write-Host 'PATCHED'
        exit 0
    } else {
        Write-Host "[-] OS build revision $buildRevision < patched threshold $($patchedBuilds[$buildKey])"
    }
}

# If IKEEXT exists and no patch detected
if ($svcStart -eq 'Disabled') {
    Write-Host '[!] IKEEXT service is Disabled — attack surface removed but host is unpatched.'
    Write-Host 'VULNERABLE (mitigated - service disabled)'
    exit 1
}

Write-Host '[-] No patched KB or build revision found. IKEEXT service is present and not disabled.'
Write-Host 'VULNERABLE'
exit 1