EUVD-2026-100387
GHSA-644g-7w4p-95g8
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach IKE endpoint on UDP 500/4500
-
DeliverySend malformed IKE negotiation packet
-
ExploitTrigger out-of-bounds read in IKE Extension
-
ExecutionReceive leaked adjacent memory
-
ImpactHarvest keys or defeat ASLR
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Bounds checking, read limits
MITRE ATT&CK
1 technique across 1 tactic: Collection The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires the target Windows host to have the IKE Extension (IKEEXT) processing inbound IKE/IPsec traffic - i.e. an IPsec/VPN or IKE endpoint reachable on UDP ports 500 and/or 4500. Per the CVSS vector (AV:N/AC:L/PR:N/UI:N) no authentication, no user interaction, and no special privileges are needed once that endpoint is reachable. The principal limiting factor is network exposure of the IKE service: hosts that do not expose IKE/IPsec to untrusted networks (default for many endpoints and workstations) are not reachable for this attack, so firewalled or non-IPsec systems are effectively out of scope. |
| Impact | This is a network-reachable (AV:N), low-complexity (AC:L), unauthenticated (PR:N) information-disclosure flaw with no user interaction (UI:N) and high confidentiality impact (C:H), yielding CVSS 7.5 HIGH. The vector signals are internally consistent - an out-of-bounds read (CWE-125) in the Windows IKE Extension leaking memory contents over the network. However, the real-world risk is more nuanced than the CVSS score alone suggests: no EPSS score is provided, the CVE is NOT on CISA KEV, and no public proof-of-concept is referenced, so there is currently no public exploit identified at time of analysis. Impact is bounded to confidentiality only (I:N/A:N) - this discloses memory (potentially cryptographic material, pointers, or buffer contents useful for defeating ASLR) but does not by itself grant code execution or affect integrity/availability. The practical priority depends heavily on whether the IKE/IPsec endpoint is actually network-exposed; many Windows hosts do not expose IKE to untrusted networks by default, which can sharply reduce the attackable population relative to the AV:N rating. Treat as a patch-soon item for IPsec/VPN gateways and any Windows host reachable on UDP 500/4500, rather than an emergency, absent evidence of exploitation. |
| Exploit ScenarioDerived | A remote, unauthenticated attacker sends a crafted IKE (Internet Key Exchange) negotiation packet to a Windows host that has the IKE Extension listening (typically UDP 500/4500 for IPsec/VPN), triggering an out-of-bounds read that returns adjacent process memory in the response or error path. The leaked memory may contain cryptographic key material, pointers (aiding ASLR bypass), or other sensitive buffer contents. No public exploit is identified at time of analysis, and the attack requires no authentication or user interaction. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 13, 2026
Information disclosure in Microsoft Windows IKE Extension (IKEEXT) allows a remote, unauthenticated attacker to send crafted IKE/IPsec traffic to UDP ports 500 or 4500 and trigger an out-of-bounds read that may disclose memory contents. The flaw is rated CVSS 7.5 HIGH with high confidentiality impact and no integrity or availability impact; the principal exposure requirement is that the target Windows host processes inbound IKE/IPsec traffic. No public exploit code or confirmed active exploitation is identified in the provided data, so no public exploit identified at time of analysis.
RemediationAI
Apply the relevant security update from Microsoft's advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-103569; the exact patched version or build is not specified in the provided data, so consult the MSRC update guide for the authoritative fix. As compensating controls, block inbound UDP 500 and 4500 from untrusted networks at the perimeter or host firewall, and restrict IKE/IPsec endpoints to known peer IP addresses. If IPsec/VPN is not required, disable the IKEEXT service. These mitigations can break legitimate VPN and IPsec connectivity and require coordination with remote-access users; blocking those ports may also affect IKEv2 clients, and disabling IKEEXT will prevent the host from negotiating IPsec tunnels.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 20 packages in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The Windows IKE Extension implements Internet Key Exchange for IPsec and is typically reachable through the IKEEXT service on UDP ports 500 and 4500. CWE-125 (Out-of-bounds Read) is the root cause class: the component reads beyond the bounds of an allocated buffer, likely while parsing malformed or unexpected IKE extension payloads, which can expose process memory contents. Because the CVSS vector is AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N, the issue is network-reachable, low-complexity, unauthenticated, and requires no user interaction, with confidentiality as the only impacted security property. No CPE identifiers or explicit affected Windows version ranges were included in the provided intelligence, so the precise scope must be confirmed through Microsoft's advisory.
Know when Windows gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Remote unauthenticated attacker reaching the IKE service triggers an OOB read with no interaction (AV:N/AC:L/PR:N/UI:N); impact is memory disclosure only, so C:H and I:N/A:N.
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
Lifecycle Timeline
2DescriptionCVE.org
Out-of-bounds read in Windows IKE Extension allows an unauthorized attacker to disclose information over a network.
Executive ViewAI
Windows hosts that accept inbound IKE/IPsec traffic - internet-facing VPN gateways, Always On VPN/DirectAccess servers, and any endpoint exposing UDP 500 or 4500 - can be made to leak portions of system memory by a remote sender that has not authenticated. Because the vulnerable code path is reachable before any credential check and Microsoft has not yet released a fix, the exposure is a perimeter and remote-access trust issue rather than an enterprise-wide outage risk. Leadership should care because leaked memory from a network security service can contain keying material, credentials, or host configuration that lowers the cost of follow-on attacks against the same remote-access infrastructure.
No vendor-released patch identified at time of analysis. Interim mitigations: restrict inbound UDP 500/4500 to known, trusted IKE/IPsec peer addresses at the perimeter and host firewall; disable the IKE and AuthIP IPsec Keying Modules (IKEEXT) service on hosts that do not terminate IKE/IPsec; block or geo-fence IKE traffic at the network edge; use IDS/IPS signatures for malformed IKE/ISAKMP packets and monitor for anomalous inbound traffic to ports 500/4500; segment and closely monitor any endpoint that must remain exposed; apply the vendor patch as soon as it is released.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Unauthenticated remote code execution in SmarterTools SmarterMail lets an attacker upload arbitrary files to any locatio
Windows Win32k fails to properly handle objects in memory, allowing local privilege escalation exploited in the wild in
A privilege escalation vulnerability (CVSS 5.5). Risk factors: actively exploited (KEV-listed), EPSS 94% exploitation pr
Windows Internet Shortcut Files (.url) contain an external control vulnerability (CVE-2025-33053, CVSS 8.8) that enables
Windows SMB contains an improper access control vulnerability (CVE-2025-33073, CVSS 8.8) enabling authenticated attacker
Twonky Server 8.5.2 on Linux and Windows allows unauthenticated access to the admin log file through a web service API b
An unrestricted file upload vulnerability exists in MiniWeb HTTP Server <= Build 300 that allows unauthenticated remote
FreeFloat FTP Server contains multiple critical design flaws that allow unauthenticated remote attackers to upload arbit
Serviio Media Server versions 1.4 through 1.8 on Windows contain an unauthenticated command injection in the /rest/actio
Twonky Server 8.5.2 uses hard-coded cryptographic keys for encrypting the administrator password. Combined with the cred
Mako Server versions 2.5 and 2.6 contain an unauthenticated OS command injection via the tutorial interface at examples/
React Native Metro Development Server binds to external interfaces by default and contains an OS command injection endpo
Exploit-DB