CVE-2026-33824: Microsoft Windows double free in IKE Extension

CVE-2026-33824 · Severity: critical · CVSS 9.8 · Exploited in the wild · Published 2026-04-14

Microsoft's Internet Key Exchange (IKE) service, used to establish secure VPN and encrypted network connections, contains a critical memory management flaw. An attacker on the network can send a malicious packet to trigger the vulnerability, allowing them to execute arbitrary code with system-level privileges. This vulnerability is currently being exploited by threat actors in active attacks.

Technologies: Microsoft Windows 11, Microsoft Windows 10. Vendors: Microsoft.

Quick answers

Is CVE-2026-33824 exploited in the wild?
Yes. CVE-2026-33824 is known to be exploited in the wild, first recorded on 18 August 2026. Treat it as urgent.
How severe is CVE-2026-33824?
Critical severity, with a CVSS score of 9.8, published 14 April 2026.
Which products and versions are affected?
Microsoft Windows 11 22H3, 23H2, 24H2, 25H2, 26H1; Microsoft Windows 10 1607, 1809, 21H2, 22H2.
Is there a fix for CVE-2026-33824?
No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-33824 attacked?
It is attacked over the network.
Am I affected by CVE-2026-33824?
Check whether you run Microsoft Internet Key Exchange (Ike) Service Extensions, Microsoft Internet Key Exchange Service Extensions, Microsoft Windows 11 or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A double free vulnerability exists in Microsoft Internet Key Exchange Service Extensions, where the same memory region is freed twice during packet processing. This memory corruption flaw can be triggered remotely by sending a specially crafted IKE protocol packet without requiring authentication. An attacker can leverage the double free to corrupt the heap, achieve arbitrary code execution, and potentially gain system-level privileges on the affected machine. The vulnerability is actively being exploited in real-world attacks.

Affected products

  • Microsoft Internet Key Exchange Service Extensions

Timeline

  • 2026-08-18: disclosed
  • exploited: Reported exploited in wild

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.