Main Vulnerability Database Vulnerabilities #VU126219

Double free in Microsoft Windows and Windows Server - CVE-2026-33824

Published: April 15, 2026 / Updated: May 22, 2026

Vulnerability identifier: #VU126219

CSH Severity: High

CVSS v4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2026-33824

CWE-ID: CWE-415

Exploitation vector: Remote access

Exploit availability: Public exploit is available

Vulnerability details

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to a boundary error in Windows Internet Key Exchange (IKE) Service Extensions. A remote attacker can pass specially crafted data to the application, trigger double free error and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Affected software

Microsoft Windows
Windows Server

How to mitigate CVE-2026-33824

Install updates from vendor's website.

Microsoft Windows - addressed in versions 10 21H2 10.0.19044.7184, 10 22H2 10.0.19045.7184, 10 1607 10.0.14393.9060, 10 1809 10.0.17763.8644, 11 23H2 10.0.22631.6936, 11 24H2 10.0.26100.32690, 11 25H2 10.0.26200.8246, 11 26H1 10.0.28000.1836
Windows Server - addressed in versions 2012 R2 6.3.9600.23132, 2016 10.0.14393.9060, 2019 10.0.17763.8644, 2022 23H2 10.0.25398.2274, 2022 10.0.20348.5020, 2025 10.0.26100.32690

Links to Public Exploits and PoC-codes

Exploit #12742 - IKEV2-POC (IKEv2, ikeext.dll, CVE-2026-33824, double free, heap grooming, ROP, SKF fragmentation, Windows exploit, anti-debug, obfuscation, API hooking, shellcode, reverse shell) (May 22, 2026)

External References

https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-33824

Related Security Bulletins

Remote code execution in Microsoft Windows Internet Key Exchange (IKE) Service Extensions