CVE-2026-33824

What is the Windows IKE Service Extensions Service?

The IKEEXT service hosts the Internet Key Exchange (IKE) and Authenticated IP (AuthIP) keying modules that Windows uses to negotiate IPsec security associations. It is the keying engine behind Windows VPN termination (IKEv2, L2TP/IPsec, Always On VPN) and behind any IPsec transport-mode or domain-isolation policy. The implementation lives in ikeext.dll, runs inside svchost.exe as SYSTEM, and listens on UDP 500 (IKE) and UDP 4500 (IKE over NAT-T).

That combination is what makes it a high-value target: the service parses attacker-supplied protocol data before any authentication has completed, and it does so with SYSTEM privileges. On a VPN gateway, RRAS server, or Always On VPN concentrator, those UDP ports are exposed to the internet by design.

Overview

CVE-2026-33824 is a double free (CWE-415) in IKEv2 fragment reassembly that allows an unauthenticated remote attacker to execute arbitrary code in the context of the IKEEXT service — that is, as SYSTEM — or to crash the service. It carries a CVSS 3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/C:H/I:H/A:H).

Microsoft patched the flaw in the April 2026 Patch Tuesday release. CISA added it to the KEV catalog on 2026-08-18 — roughly four months later — with a remediation deadline of 2026-08-21, a three-day window under BOD 26-04 that reflects confirmed in-the-wild exploitation rather than the usual three-week timeline.

Affected Versions

All currently supported Windows 10, Windows 11, and Windows Server releases ship the vulnerable IKE service. Additional KB numbers apply to other builds — consult the MSRC entry for the update matching your exact version.

Technical Details

The bug is an ownership error, not a bounds error. When IKEEXT reassembles a fragmented IKE_AUTH message, IkeReinjectReassembledPacket() performs a shallow copy of a Security Realm blob pointer into a work item. Ownership of the underlying heap allocation is never transferred or cleared, so two separate code paths each believe they are responsible for releasing it:

1. IkeDestroyPacketContext() frees the blob when tearing down the packet context.
2. IkeFreeMMSA() frees the same pointer again during main-mode security association (MMSA) cleanup.

The result is a classic CWE-415 double free. The second release corrupts heap metadata, and an attacker who can shape intervening allocations can turn that corruption into control of a freed chunk and, from there, into code execution inside a SYSTEM-level service.

The trigger sequence is short and entirely pre-authentication:

• Send an IKE_SA_INIT message carrying the Microsoft Security Realm Vendor ID.
• Follow it with two or more encrypted fragment (SKF) payloads containing an invalid IKE_AUTH message.

No credentials, no user interaction, and no prior foothold are required — only network reachability to UDP 500 or 4500 on a host where the IKE service is active. Attack complexity is rated Low, and the whole sequence fits in a handful of UDP packets.

Discovery

The vulnerability was found internally by Microsoft's WARP & MORSE teams. Trend Micro's Zero Day Initiative published a public root-cause analysis on 2026-04-22, naming the specific functions and the fragment sequence needed to reach the double free.

Exploitation Context

CISA confirmed active exploitation when it added the CVE to KEV on 2026-08-18; no specific threat actor or campaign has been publicly attributed. CISA described the flaw as posing significant risk to the federal enterprise and set a three-day federal remediation deadline.

Two factors make the exposure worse than the raw CVSS suggests:

• The exposed population is concentrated but critical. IKEEXT is present on every supported Windows install, but the hosts that actually accept inbound UDP 500/4500 from untrusted networks are VPN concentrators, RRAS servers, and Always On VPN gateways — precisely the systems that sit at the network edge and hold privileged position inside it.
• The public analysis predates exploitation by four months. ZDI's function-level write-up has been available since April 2026, substantially lowering the work required to build a working exploit. The gap between patch availability and KEV listing means many organisations treated an April critical as routine.

Remediation

1. Apply the April 2026 or later cumulative update for every affected Windows build. This is the only complete fix.
2. Restrict inbound UDP 500 and 4500 to allow-lists of known, trusted IKE peers — at both the perimeter and the host firewall. Hosts that terminate no IPsec tunnels should reject this traffic outright.
3. Disable the IKEEXT service on systems with no validated business requirement for IPsec or IKE-based VPN.
4. Prioritise internet-facing VPN gateways first, then internal hosts covered by domain-isolation or IPsec transport policies.
5. Review logs for IKEEXT instability — unexpected termination or repeated restarts of the svchost.exe instance hosting IKEEXT is the most likely artefact of a failed exploitation attempt, since an unsuccessful double free typically crashes the service rather than executing cleanly.