A double free in the Windows service handling VPN key exchange — Windows leads the product mix at 172 entries
Microsoft Internet Key Exchange (IKE) Service Extensions contain a double free vulnerability that could enable remote code execution. It was added to the CISA Known Exploited Vulnerabilities catalog on 2026-08-18 with a due date three days later.
Key facts
- CVE IDCVE-2026-33824
- Affected (vendor / product)Microsoft Internet Key Exchange (IKE) Service Extensions
- CWECWE-415
- ExploitationListed in CISA KEV (exploitation confirmed)
- Remediation due2026-08-21 (U.S. federal civilian agencies, BOD 22-01)
Key points
- Microsoft Internet Key Exchange (IKE) Service Extensions contain a double free (CWE-415) that could enable remote code execution.
- IKE is the procedure for agreeing keys before IPsec communication begins — the opening handshake of a VPN connection.
- Added to KEV on 2026-08-18 with a due date of 2026-08-21, a three-day grace period.
- Across the 1,687 records this site holds as of 2026-09-02 there are 680 distinct product names, led by Windows with 172.
- Next come Multiple Products with 79, Chromium V8 with 39, Internet Explorer with 36, Flash Player with 33 and Kernel with 31.
1A component beneath the machinery that protects traffic
Internet Key Exchange is the procedure by which two parties agree securely on the keys they will use before IPsec encrypted communication begins. It is the opening handshake of a VPN connection, and however strong the cipher, a flaw in that arrangement undermines the whole. This entry concerns a double free in the Windows service extensions that carry out the procedure.
2What a double free does
Freeing the same memory region twice leaves a reference pointing at memory already released. If that region is reused for another purpose before the reference is used, a state arises in which content placed by an attacker can be treated unintentionally. The record states that remote code execution could be enabled.
Key exchange also runs at the very start of a connection, which often makes it reachable before authentication completes.
3Its place in the product mix
Counting the records by product name, Windows leads with 172. Widely deployed platform software tends to be worth the attacker investment and also draws more eyes from researchers. A high count does not by itself mean a weaker product, but for defenders it is a reasonable basis for prioritizing the names that appear most often.
4A three-day grace period
The due date is three days after the addition. Across the 1,687 records this site holds as of 2026-09-02, the median grace period is 21 days, so this is considerably shorter than typical. Given that the function concerns the VPN connection path, that reads as reflecting both broad reach and an exposed position.
The required action is to apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use. Verify applicability with official vendor information and your own environment.
Why it matters
A flaw at the key-exchange stage undermines the whole path regardless of cipher strength. That Windows leads the product mix is usable data when setting the order of an asset inventory.
FAQ
Why does a double free lead to code execution?
Does Windows leading the count mean it is weaker?
Sources (primary)
This article is an independent organization based on the U.S. official data below. Always verify the exact, latest details and applicability with the official and vendor sources.
- CISA KEV Catalog (known exploited list)
- NVD (CVE details / CVSS)
- Vendor / reference advisory
- This product uses data from the NVD API but is not endorsed or certified by the NVD. KEV data is CC0 (public domain).