Windows IKE Extension EUVD-2026-100005

Exploitation requires network reachability to the Windows IKE/AuthIP Keying Module (IKEEXT service) that processes ISAKMP/IKE negotiation traffic, typically UDP ports 500 and 4500. Hosts actively exposing IPsec or IKE - VPN gateways, servers with IPsec policies, and clients negotiating IKE - are the realistic targets; a Windows system that neither listens for nor processes IKE packets is not reachable via this path. No authentication and no user interaction are needed (PR:N/UI:N), and complexity is low (AC:L), so the primary limiting factor is whether the IKE endpoint is network-exposed and actively handling IKE negotiation. Impact is limited to denial of service (availability only); no data disclosure or code execution results.

This is a real but moderate-priority issue rather than a critical emergency. The CVSS 3.1 base score of 7.5 (HIGH) is driven entirely by availability impact (A:H) with no confidentiality or integrity effect (C:N/I:N) - this is a pure denial-of-service flaw, not remote code execution, despite being a heap overflow (CWE-122). The vector AV:N/AC:L/PR:N/UI:N is favorable to an attacker: network-reachable, low complexity, no privileges, no user interaction. CISA's SSVC framework reinforces a measured view: Exploitation=none (no observed exploitation), Automatable=yes (the attack can be scripted and scaled across many hosts), and Technical Impact=partial (consistent with DoS rather than full system compromise). No KEV listing and no public POC were provided, and no EPSS probability was supplied, so exploitation likelihood cannot be quantified numerically - this absence should be noted, not treated as 'low risk confirmed.' The signals are internally consistent (CVSS availability-only matches SSVC partial impact matches the DoS description), so there is no contradiction to flag. Net: patch promptly on internet-facing or IPsec/VPN-exposed Windows hosts because the flaw is unauthenticated, low-complexity, and automatable, but it does not grant code execution or data access, so it ranks below RCE-class issues for prioritization.

A remote, unauthenticated attacker sends a crafted IKE/ISAKMP negotiation packet to a Windows host whose IKE Extension (IKEEXT) service is processing IPsec/IKE traffic, triggering a heap-based buffer overflow that crashes the service and denies IPsec/VPN connectivity. Because the vector is AV:N/AC:L with no authentication or user interaction, and SSVC rates it Automatable=yes, the attack could be scripted against many exposed endpoints. No public exploit identified at time of analysis.