Vulnerabilities & PatchesEmerging1 src
CVE-2026-33824: Remote Code Execution in Windows IKEv2
In this excerpt of a TrendAI Research Services vulnerability report, Richard Chen and Lucas Miller of the TrendAI Research team detail a recently patched double free vulnerability in the Windows Internet Key Exchange (IKE) service. This bug was originally discovered by WARP & MORSE team at Microsoft. Successful exploitation could result in a crash of the IKEEXT service, or potentially arbitrary code execution.
The following is a portion of their write-up covering CVE-2026-33824, with a few minimal modifications. A double free vulnerability has been reported in the Windows Internet Key Exchange (IKEv2) service. The vulnerability is due to an error when processing fragments. An unauthenticated, remote attacker could exploit this vulnerability by sending crafted packets to the target server.