ZDI-26-622: Microsoft Windows IKEv2 AES-GCM Decryption Integer Underflow Remote Code Execution Vulnerability
ZDI disclosed CVE-2026-50696, a CVSS 8.1 integer underflow in Windows IKEv2 AES-GCM decryption enabling unauthenticated remote code execution on specific IPsec configurations.
The Zero Day Initiative published ZDI-26-622 describing a remote code execution vulnerability in Microsoft Windows' IKEv2 AES-GCM decryption path, caused by an integer underflow. Authentication is not required for exploitation, but only systems using specific IPsec configurations are affected. ZDI assigned the vulnerability a CVSS score of 8.1 and the identifier CVE-2026-50696.
- ZDI-26-622 covers an integer underflow in Windows IKEv2 AES-GCM decryption
- Unauthenticated remote attackers can achieve arbitrary code execution
- Only hosts with specific IPsec configurations are vulnerable
- CVSS 8.1; tracked as CVE-2026-50696
- CVEs
- CVE-2026-50696
- Vendors
- MicrosoftZero Day Initiative
- Products
- Windows
- Organizations
- Zero Day Initiative
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-50696 | Heap-based buffer overflow in Windows Internet Key Exchange (IKE) Protocol allows an unauthorized attacker to deny service over a network | 7.5 | 1% |
From the original article
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Microsoft Windows. Authentication is not required to exploit this vulnerability, but only systems with specific IPsec configurations are vulnerable. The ZDI has assigned a CVSS rating of 8.
zerodayinitiative.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.