Zero Day Initiative — CVE-2026-33824: Remote Code Execution in Windows ...
Found by web discovery while looking for coverage of CVE-2026-33824
ZDI details CVE-2026-33824, a double-free in Windows IKEv2 fragment reassembly enabling unauthenticated remote code execution as SYSTEM on Windows.
Zero Day Initiative published technical analysis of CVE-2026-33824, a double-free in the Windows IKE Extension (ikeext.dll) caused by improper ownership handling of a heap blob pointer during IKEv2 fragment reassembly in IkeReinjectReassembledPacket(). A remote unauthenticated attacker can send a crafted IKE_SA_INIT message with a Security Realm Vendor ID followed by fragmented IKE_AUTH payloads to trigger the double free. Successful exploitation could yield arbitrary code execution under the IKEEXT service context (SYSTEM). ZDI also provided IDS detection guidance correlating the two-packet sequence on UDP ports 500 and 4500.
- Double-free arises from aliased blob pointers between the MMSA structure and queued work items.
- Attack chain: IKE_SA_INIT with Microsoft Security Realm Vendor ID, then two or more Encrypted Fragment (SKF) payloads with an invalid IKE_AUTH message.
- Exploitation yields code execution in the IKEEXT service context (SYSTEM).
- Detection guidance correlates the two-packet sequence on UDP ports 500 and 4500.
- CVEs
- CVE-2026-33824
- Vendors
- MicrosoftZero Day Initiative
- Products
- Windows IKE Extensionikeext.dll
- Organizations
- Zero Day InitiativeTrend Micro
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-33824 | Unauthenticated Double-Free RCE in Microsoft Windows IKE Extension | 9.8 | 77% | KEV | KEV |
From the original article
3 min read at zerodayinitiative.comFind us on Blog CVE-2026-33824: Remote Code Execution in Windows IKEv2 April 23, 2026 TrendAI Research Team In this excerpt of a TrendAI Research Services vulnerability report, Richard Chen and Lucas Miller of the TrendAI Research team detail a recently patched double free vulnerability in the Windows Internet Key Exchange (IKE) service.
By TrendAI Research Team · zerodayinitiative.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.