EUVD-2026-29632
GHSA-g3x8-gm4j-w8q6
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Remote unauthenticated packets to the IKE service with low complexity (AV:N/AC:L/PR:N/UI:N); memory-leak DoS yields availability-only impact (A:H, C:N/I:N).
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
2DescriptionCVE.org
Missing release of memory after effective lifetime in Windows Internet Key Exchange (IKE) Protocol allows an unauthorized attacker to deny service over a network.
AnalysisAI
Denial of service in the Windows Internet Key Exchange (IKE) protocol implementation allows remote unauthenticated attackers to exhaust host memory across all supported Windows client and server releases (Windows 10 1607 through Windows 11 26H1, Windows Server 2012 through Server 2025). The flaw is a memory leak (CWE-401) triggered over the network with no privileges or user interaction, but impact is limited to availability with no data exposure. There is no public exploit identified at time of analysis, and EPSS exploitation probability is very low (0.08%, 23rd percentile).
Technical ContextAI
IKE is the key-negotiation protocol underpinning IPsec VPNs and IPsec-secured traffic on Windows, handled by the IKEEXT service (over UDP 500/4500). The root cause is CWE-401, Missing Release of Memory After Effective Lifetime: the IKE handler allocates memory for incoming negotiation packets but fails to free it under certain conditions, so each malicious or malformed exchange leaks memory that is never reclaimed. Sustained delivery of such packets gradually exhausts non-paged pool or process memory, degrading or crashing the service. The CPE set spans the Microsoft Windows OS line broadly, confirming this lives in the shared IKE/IPsec stack rather than a single edition-specific feature.
RemediationAI
Apply the Microsoft security update for CVE-2026-35424, upgrading each edition to at least the fixed build listed in the advisory (for example Windows 11 24H2 to 10.0.26100.8457, Server 2025 to 10.0.26100.32860, Server 2022 to 10.0.20348.5139, Windows 10 22H2 to 10.0.19045.7291); consult https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-35424 for the exact build per SKU. Where patching must be deferred on exposed hosts, reduce the IKE attack surface by restricting UDP 500 and 4500 with host or perimeter firewall rules so that only trusted VPN peers can reach the IKEEXT service - this blocks the untrusted-source leak vector but will break IPsec/IKE negotiation from any peer that is filtered out, so scope rules to legitimate VPN endpoints only. On systems that do not use IPsec/IKE, disabling the IKE and AuthIP IPsec Keying Modules (IKEEXT) service removes the vulnerable surface entirely, at the cost of IPsec functionality.
More in Windows Server 2012
View allWindows MSHTML component contains a remote code execution vulnerability that allows attackers to craft malicious ActiveX
<p>A remote code execution vulnerability exists when the Windows Print Spooler service improperly performs privileged fi
Remote code execution in Microsoft Office 2007-2016 and Windows Vista through 10 allows attackers to execute arbitrary c
Windows MSDT (Microsoft Support Diagnostic Tool) allows remote code execution when called via the ms-msdt URL protocol f
The SMBv1 server in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows
The Windows VBScript engine contains a remote code execution vulnerability in object handling that allows full system co
Windows Print Spooler Remote Code Execution Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is no auth
The Win32k kernel-mode driver in Windows Vista through Windows Server 2016 allows local privilege escalation, exploited
Windows Search Remote Code Execution Vulnerability. Rated high severity (CVSS 7.5), this vulnerability is remotely explo
An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in
An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in
Active Directory Domain Services Elevation of Privilege Vulnerability. Rated high severity (CVSS 7.5), this vulnerabilit
Same weakness CWE-401 – Memory Leak
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today