# CVE-2026-33824: Windows IKE Extensions Unauthenticated RCE via Double Free

> Critical unauthenticated remote code execution vulnerability in Windows Internet Key Exchange (IKE) Service Extensions. A double free condition (CWE-415) in IKEv2 packet processing allows attackers to achieve arbitrary code execution with SYSTEM privileges by sending specially crafted UDP packets to ports 500/4500, requiring no authentication or user interaction. CVSS 9.8.

- **Published:** 2026-04-15T12:00:00Z
- **Last reviewed:** 2026-08-23T04:59:12.907Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-0365
- **ID:** TL-2026-0365
- **Severity:** CRITICAL (CVSS 9.8)
- **Category:** VULNERABILITY
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 45 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2026-33824

## Description

CVE-2026-33824 is a critical remote code execution vulnerability in the Windows Internet Key Exchange (IKE) Service Extensions, specifically affecting IKEv2 implementations across all supported Windows versions. The vulnerability was disclosed and patched by Microsoft as part of the April 2026 Patch Tuesday release on April 14, 2026.

The root cause is a double free memory corruption flaw (CWE-415) in the ikeext service component (ikeext.dll) that handles IKEv2 key exchange negotiations for IPSec VPN tunnels. When the IKE service processes specially crafted network packets, it incorrectly attempts to free the same block of heap memory twice. This double free condition corrupts the heap allocator metadata, allowing an attacker to manipulate the state of the memory allocator and achieve arbitrary code execution.

The vulnerability carries maximum exploitability characteristics: it is network-accessible via UDP ports 500 (IKE) and 4500 (IKE NAT-Traversal), requires no authentication (pre-auth), requires no user interaction, and has low attack complexity. The CVSS v3.1 base score is 9.8 (Critical) with the vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. Successful exploitation grants the attacker SYSTEM-level privileges on the target host, as the IKEEXT service runs under the Local System account.

The attack surface is significant because IKE is a fundamental component of IPSec VPN infrastructure. Any Windows system running the IKEEXT service with IKEv2 enabled — including VPN gateways, domain controllers in site-to-site VPN configurations, and servers with IPSec transport mode policies — is potentially exposed. The service listens on UDP ports 500 and 4500, which must be accessible from the network for IPSec to function, making firewall-based mitigation challenging for organizations that depend on IKE/IPSec.

This vulnerability continues a pattern of critical IKE-related flaws in Windows. CVE-2022-34721, patched in September 2022, was a similar IKE Protocol Extensions RCE vulnerability that was addressed by adding length validation checks on incoming data. The IKEEXT service has also been the subject of historical DLL hijacking vulnerabilities affecting Windows Vista through Server 2012, where the service attempted to load non-existent DLLs.

Affected systems span a wide range of Windows versions: Windows 10 (versions 1607, 1809, 21H2, 22H2), Windows 11 (versions 22H2, 23H2, 24H2, 25H2, 26H1), and Windows Server 2016, 2019, 2022, and 2025 across 32-bit, x64, and ARM64 architectures. Microsoft released patches as part of the April 2026 Patch Tuesday update cycle with specific KB articles for each affected version.

As of disclosure, there is no evidence of active exploitation in the wild, no public proof-of-concept code, and the vulnerability has not been added to the CISA Known Exploited Vulnerabilities (KEV) catalog. Microsoft assesses exploitation as less likely in the latest software releases. However, the pre-authentication, network-accessible nature of the flaw makes it a high-priority patching target, as weaponization could enable wormable exploitation across enterprise networks.

## MITRE ATT&CK

- T1190 Exploit Public-Facing Application
- T1203 Exploitation for Client Execution
- T1210 Exploitation of Remote Services
- T1068 Exploitation for Privilege Escalation
- T1211 Exploitation for Stealth
- T1595 Active Scanning
- T1046 Network Service Discovery
- T1499 Endpoint Denial of Service
- T1588 Obtain Capabilities
- T1587 Develop Capabilities
- T1059 Command and Scripting Interpreter
- T1543 Create or Modify System Process
- T1053 Scheduled Task/Job
- T1574 Hijack Execution Flow
- T1518 Software Discovery
- T1071 Application Layer Protocol
- T1588.005 Obtain Capabilities: Exploits
- T1583.006 Acquire Infrastructure: Web Services
- T1588.002 Obtain Capabilities: Tool
- T1588.006 Obtain Capabilities: Vulnerabilities
- T1596.005 Search Open Technical Databases: Scan Databases
- T1595.002 Active Scanning: Vulnerability Scanning
- T1562.001 Impair Defenses: Disable or Modify Tools
- T1070.004 Indicator Removal: File Deletion
- T1102.002 Web Service: Bidirectional Communication
- T1090.002 Proxy: External Proxy
- T1499.004 Endpoint Denial of Service: Application or System Exploitation
- T1059.006 Command and Scripting Interpreter: Python

## Sources

- [Microsoft MSRC Advisory — CVE-2026-33824](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-33824)
- [CIRCL Vulnerability Lookup — CVE-2026-33824](https://vulnerability.circl.lu/vuln/msrc_cve-2026-33824)
- [CrowdStrike April 2026 Patch Tuesday Analysis](https://www.crowdstrike.com/en-us/blog/patch-tuesday-analysis-april-2026/)
- [Tenable — Microsoft April 2026 Patch Tuesday Addresses 163 CVEs](https://www.tenable.com/blog/microsofts-april-2026-patch-tuesday-addresses-163-cves-cve-2026-32201)
- [Qualys — Microsoft and Adobe Patch Tuesday April 2026 Review](https://blog.qualys.com/vulnerabilities-threat-research/2026/04/14/microsoft-and-adobe-patch-tuesday-april-2026-security-update-review)
- [Rapid7 — Patch Tuesday April 2026](https://www.rapid7.com/blog/post/em-patch-tuesday-april-2026/)
- [Cybersecurity News — Microsoft Patch Tuesday April 2026](https://cybersecuritynews.com/microsoft-patch-tuesday-april-2026/)
- [Action1 — Patch Tuesday April 2026](https://www.action1.com/patch-tuesday/patch-tuesday-april-2026/)
- [GitHub Advisory — GHSA-q6qf-3m2m-xq4f](https://github.com/advisories/GHSA-q6qf-3m2m-xq4f)
- [Feedly CVE Intelligence — CVE-2026-33824](https://feedly.com/cve/CVE-2026-33824)
- [WindowsNews — CVE-2026-33824 Demands Immediate Patching](https://windowsnews.ai/article/cve-2026-33824-microsofts-high-confidence-windows-ike-rce-vulnerability-demands-immediate-patching.413122)
- [CSO Online — April Patch Tuesday Zero Days and Critical Bugs](https://www.csoonline.com/article/4158706/april-patch-tuesday-roundup-zero-day-vulnerabilities-and-critical-bugs.html)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-0365