CVE-2026-33824

The double free vulnerability (CWE-415) consists of freeing the same memory area twice by the vulnerable component. An attacker can send specially crafted network packets to the IKE Extension service, causing heap corruption. This allows the attacker to take control over the process execution flow and execute arbitrary code in the context of the vulnerable service, without the need for any privileges or user interaction.

An unauthenticated remote attacker can remotely execute arbitrary code on a vulnerable system, which may lead to complete system takeover, disclosure of sensitive data, or disruption of its availability.

Security patches available from the vendor should be applied according to references (https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-33824). Additionally, it is recommended to restrict network access to IKE services (UDP ports 500 and 4500) only to trusted hosts using firewall rules, as a temporary measure until the patch is deployed.

Microsoft Windows 10 22H2, Microsoft Windows 11 23H2, Microsoft Windows 11 26H1, Microsoft Windows Server 2022, Microsoft Windows Server 2022 23H2

Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.

Microsoft Internet Key Exchange (IKE) Service Extensions contains a double free vulnerability that could enable remote code execution.