CVE-2026-33824

CVE-2026-33824 is a double free vulnerability in Windows IKE Extension that permits unauthenticated remote code execution. The flaw resides in a core Windows networking component and affects systems running vulnerable IKE implementations. This memory corruption issue allows attackers to corrupt heap memory structures, leading to arbitrary code execution with system-level privileges. The vulnerability carries a CVSS score of 9.8 (Critical) due to its network attack vector, low complexity, and lack of required authentication or user interaction. The attack requires no privileges and impacts confidentiality, integrity, and availability equally. The FAUCET risk score of 55.0 indicates a moderate-to-high risk profile requiring prioritization. Currently, there is no evidence of active exploitation in the wild, as indicated by the absence of the CVE from the Known Exploited Vulnerabilities catalog and its inactive status on threat tracking lists. The EPSS score of 0.00096 suggests exploitation probability remains low relative to the broader CVE population. However, the critical CVSS rating warrants immediate patching efforts given the severe potential impact if exploitation occurs.