Windows IKE Extension EUVD-2026-72972

Exploitation requires that the target system has the IKE and AuthIP IPsec Keying Modules service (ikeext) running and reachable over UDP 500 or 4500 - conditions met on any Windows host with IPsec or IKEv2 VPN configured. The CVSS PR:L metric confirms the attacker must be 'authorized', meaning they need a valid IKE peer identity (e.g., a certificate, pre-shared key, or domain credential accepted by the IKE policy on the target). AC:H indicates a non-trivial precondition - likely a specific IKE handshake phase or heap state - must be satisfied. Exploitation is limited by: requirement for at least low-level authorization/authentication to the IKE service, high attack complexity reducing automated exploitation, and non-default network exposure (systems not configured for IPsec/VPN may not expose ikeext to untrusted networks).

The CVSS 3.1 vector CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H scores 7.5 and reflects the key constraints: High Attack Complexity (IKE state-machine conditions must be satisfied, likely requiring a valid IKE handshake state or timing window) and Low Privilege (the attacker must be 'authorized', consistent with an established IPsec peer or VPN account). Despite AV:N, exploitation is not trivial - AC:H materially lowers automated mass-exploitation risk. No public exploit code or KEV listing is present, which aligns with a moderately complex heap-overflow path. EPSS data was not provided; given the authentication requirement and high complexity, opportunistic mass exploitation is unlikely in the near term. However, the target service (ikeext) runs as SYSTEM, so successful exploitation carries maximum local impact. Organizations running IPsec/VPN with externally reachable IKE endpoints (e.g., road-warrior VPN concentrators) carry the greatest residual risk until patched.

An authenticated IKE peer - such as a compromised VPN client account or a rogue IKE responder on the same network segment - initiates an IKE negotiation with the vulnerable Windows endpoint, sending a specially crafted IKE packet that triggers a heap overflow in ikeext during message processing. The overflow corrupts heap metadata or a function pointer, redirecting execution to attacker-controlled shellcode running as SYSTEM. No public proof-of-concept exploit has been identified at time of analysis, and the AC:H rating suggests reliable exploitation requires careful heap-layout manipulation.