Micropatches released for Windows Internet Key Exchange Service Extensions RCE (CVE-2026-33824)
April 2026 Windows Updates brought a patch for CVE-2026-33824, a remote code execution vulnerability in Windows IKE Extension, allowing an unauthorized attacker in the network to cause memory corruption in a privileged service on another computer in the network and potentially execute privileged arbitrary code there.
The vulnerability was found internally by Microsoft WARP & MORSE team. We recreated a POC from the official patch, which allowed us to reproduce the issue and create patches for legacy Windows systems.
The Vulnerability
This is a pre-authentication double free in ikeext.dll, the module behind the "IKE and AuthIP IPsec Keying Modules" service, which runs as Local System inside a svchost.exe. The flaw is in function IkeReinjectReassembledPacket, on the IKEv2 fragment reassembly path. An unauthenticated attacker who can reach UDP 500/4500 on a host that acts as an IKEv2 responder can free the same heap block twice, resulting inpotentially exploitable memory corruption.
Microsoft's Patch
Microsoft fixed this issue by making sure the same pointer to a to-be-freed blob is not being used in two locations.
Our Patch
Our patch is logically identical to Microsoft's.
Let's see our patch in action. With 0patch disabled, a vulnerable Windows 11 computer (on the left) has the IKEv2 responder enabled. Attacker (computer on the right) runs the POC to trigger a double free and a subsequent crash of the vulnerable service.
With 0patch enabled, the POC fails to crash the service.
Micropatch Availability
Micropatches were written for the following security-adopted Windows versions:
Windows 11 v22H2 - fully updated
Windows 11 v21H2 - fully updated
Windows 10 v22H2 - fully updated
Windows 10 v21H2 - fully updated
Windows 10 v21H1 - fully updated
Windows 10 v20H2 - fully updated
Windows 10 v2004 - fully updated
Windows 10 v1909 - fully updated
Windows 10 v1809 - fully updated
Windows 10 v1803 - fully updated
We found Windows 7 and Windows Servers 2008 R2, 2012 and 2012 R2 to not be affected by this issue.
Micropatches have already been distributed to, and applied on, all affected online computers with 0patch Agent in PRO or Enterprise accounts (unless Enterprise group settings prevented that).
Vulnerabilities like these get discovered on a regular basis, and attackers know about them all. If you're using Windows that aren't receiving official security updates anymore, 0patch will make sure these vulnerabilities won't be exploited on your computers - and you won't even have to know or care about these things.
We'd like to thank Microsoft for finding this vulnerability and having it patched, which allowed us to create patches for Windows versions that are no longer receiving official updates from Microsoft.
If you're new to 0patch, create a free account in 0patch Central, start a free trial, then install and register 0patch Agent. Everything else will happen automatically. No computer reboot will be needed.
Did you know 0patch security-adopted Windows 10 and Office 2016 and 2019 when they went out of support in October 2025, allowing you to keep using them for at least 3 more years (5 years for Windows 10)? Read more about it here and here.
Note that we will soon security-adopt the following products:
Windows 10 22H2 with Extended Security Updates year 1: October 2026
Windows Server 2012 with Extended Security Updates year 3: October 2026
Windows Server 2012 R2 with Extended Security Updates year 3: October 2026
Windows Office 2021: October 2026
Windows 11 23H2 (E): November 2026
Windows Server 2016: January 2027
To learn more about 0patch, please visit our Help Center.