Microsoft Windows IKE Extension Double Free Enables Unauthenticated Remote Code Execution

Double free in Windows IKE Extension allows an unauthorized attacker to execute code over a network.

• Windows 10 Version 1607: from 10.0.14393.0 through builds below 10.0.14393.9060.
• Windows 10 Version 1809: from 10.0.17763.0 through builds below 10.0.17763.8644.
• Windows 10 Version 21H2: from 10.0.19044.0 through builds below 10.0.19044.7184.
• Windows 10 Version 22H2: from 10.0.19045.0 through builds below 10.0.19045.7184.
• Windows 11 version 22H3: from 10.0.22631.0 through builds below 10.0.22631.6936.
• Windows 11 Version 23H2: from 10.0.22631.0 through builds below 10.0.22631.6936.
• Windows 11 Version 24H2: from 10.0.26100.0 through builds below 10.0.26100.8246.
• Windows 11 Version 25H2: from 10.0.26200.0 through builds below 10.0.26200.8246.
• Windows 11 version 26H1: from 10.0.28000.0 through builds below 10.0.28000.1836.
• Windows Server 2016: from 10.0.14393.0 through builds below 10.0.14393.9060.
• Windows Server 2016 (Server Core installation): from 10.0.14393.0 through builds below 10.0.14393.9060.
• Windows Server 2019: from 10.0.17763.0 through builds below 10.0.17763.8644.
• Windows Server 2019 (Server Core installation): from 10.0.17763.0 through builds below 10.0.17763.8644.
• Windows Server 2022: from 10.0.20348.0 through builds below 10.0.20348.5020.
• Windows Server 2022, 23H2 Edition (Server Core installation): from 10.0.25398.0 through builds below 10.0.25398.2274.
• Windows Server 2025: from 10.0.26100.0 through builds below 10.0.26100.32690.
• Windows Server 2025 (Server Core installation): from 10.0.26100.0 through builds below 10.0.26100.32690.

The normalized record does not establish the status of Windows branches outside this list. Unlisted branches should not be assumed to be unaffected.

The Microsoft Windows IKE Extension processes Internet Key Exchange traffic on affected Windows systems. The weakness is a double free, in which the same memory allocation is released more than once, potentially corrupting memory-management state and enabling code execution if successfully exploited. The attacker-controlled input is network traffic reaching the IKE component, but the available evidence does not describe the packet format, processing function, allocation structure, or payload. The record establishes network reachability, no authentication requirement, and no user interaction. The affected scope includes the listed Windows client and Windows Server branches, including Server Core installations. The evidence does not establish whether every IKE deployment is reachable or whether additional configuration conditions are required beyond access to the IKE component.

The vulnerability is network-reachable, has low attack complexity, requires no privileges, and requires no user interaction. The normalized record marks it as known exploited and indicates that a public exploit is available. Unit 42 reported active exploitation activity, including reverse shell callback attempts targeting three IKE VPN endpoints. The reviewed evidence does not confirm successful code execution on those endpoints, so observed exploitation attempts should not be treated as confirmed compromise.

Successful exploitation could allow an unauthenticated remote attacker to execute code on a Windows system processing IKE traffic. The record identifies high confidentiality, integrity, and availability impact, but it does not state the exact execution context or resulting privilege level. On a VPN or perimeter system, possible consequences include service disruption, unauthorized configuration changes, or use of the host as a foothold for further internal access. These are potential technical and organizational consequences, not evidence of a specific breach or data disclosure. The available exploitation evidence confirms reverse shell attempts against IKE endpoints but does not confirm successful code execution on those targets.

1. Operational risk: A Windows VPN or perimeter system may be used for remote code execution, increasing the risk of disruption to remote-access services and network connectivity.
2. Data and control risk: Code execution could affect the confidentiality, integrity, and availability of the affected system. The specific consequences depend on the deployment context and the execution privileges of the impacted component.
3. Propagation risk: If a perimeter system is compromised, an attacker could use it as a foothold for further internal discovery or attack. This is a possible consequence, not a confirmed outcome in the available evidence.
4. Because active exploitation has been observed, IKE endpoints accessible from the Internet or other untrusted networks should receive priority for inventory, exposure review, and patching.

1. Install the applicable Microsoft security update for the operating system branch and IKE component on every affected system.
2. Verify the post-update build for each branch:

• Windows 10 Version 1607, Windows Server 2016, and Windows Server 2016 (Server Core installation) must not be below 10.0.14393.9060.
• Windows 10 Version 1809, Windows Server 2019, and Windows Server 2019 (Server Core installation) must not be below 10.0.17763.8644.
• Windows 10 Version 21H2 must not be below 10.0.19044.7184.
• Windows 10 Version 22H2 must not be below 10.0.19045.7184.
• Windows 11 version 22H3 and Windows 11 Version 23H2 must not be below 10.0.22631.6936.
• Windows 11 Version 24H2 must not be below 10.0.26100.8246.
• Windows 11 Version 25H2 must not be below 10.0.26200.8246.
• Windows 11 version 26H1 must not be below 10.0.28000.1836.
• Windows Server 2022 must not be below 10.0.20348.5020.
• Windows Server 2022, 23H2 Edition (Server Core installation) must not be below 10.0.25398.2274.
• Windows Server 2025 and Windows Server 2025 (Server Core installation) must not be below 10.0.26100.32690.

1. Prioritize systems whose IKE/VPN endpoints accept connections from the Internet or other untrusted networks because active exploitation has been observed.
2. If immediate patching is not possible, reduce unnecessary untrusted-network access to IKE endpoints and increase monitoring of network connections, process creation, and outbound activity. This is temporary risk reduction, not a confirmed fix.
3. For systems showing suspicious activity, investigate activity before and after patching so that prevention of further exploitation is not confused with evidence that the system was never compromised. The supplied evidence does not provide a Microsoft-confirmed workaround or a specific IOC list.

1. Inventory Windows systems that install or expose IKE/VPN functionality, including Windows Server and Server Core systems.
2. Check the operating system build on each system and compare it with the branch-specific ranges in affected_summary; do not rely only on the product name or support status.
3. Identify IKE endpoints reachable from untrusted networks, including endpoints behind NAT, firewalls, or perimeter VPN infrastructure.
4. Review network and EDR telemetry for unusual IKE connections followed by process creation, unexpected outbound connections, or reverse-shell-like behavior. This is precautionary monitoring, not a confirmed vulnerability-specific IOC.
5. If suspicious activity is found on an unpatched system, preserve logs and investigative data, restrict network access according to incident-response procedures, and check for post-connection code execution or persistence.