Microsoft Windows: Heap-based buffer overflow in IKE Extension

Summary

A heap-based buffer overflow in the Windows Internet Key Exchange (IKE) Extension allows an unauthenticated attacker on the network to crash the IKE service. This causes a denial of service for IPsec and VPN connections on affected hosts. Exposure is highest for Windows hosts that run IPsec, IKEv2 or L2TP VPN roles and accept traffic from the internet. The CNA rates the issue 7.5 (High) with availability impact only.

Affected

• Windows 10 Version 1607 (10.0.14393.0 to < 10.0.14393.9612)
• Windows 10 Version 1809 (10.0.17763.0 to < 10.0.17763.9376)
• Windows 10 Version 21H2 (10.0.19044.0 to < 10.0.19044.7807)
• Windows 10 Version 22H2 (10.0.19045.0 to < 10.0.19045.7807)
• Windows 11 Version 23H2 (10.0.22631.0 to < 10.0.22631.7652)
• Windows 11 Version 24H2 (10.0.26100.0 to < 10.0.26100.9711)
• Windows 11 Version 25H2 (10.0.26200.0 to < 10.0.26200.9711)
• Windows 11 Version 26H1 (10.0.28000.0 to < 10.0.28000.3231)
• Windows 11 Version 26H2 (10.0.26300.0 to < 10.0.26300.9711)
• Windows Server 2012 and Server Core (6.2.9200.0 to < 6.2.9200.26434)
• Windows Server 2012 R2 and Server Core (6.3.9600.0 to < 6.3.9600.23470)
• Windows Server 2016 (10.0.14393.0 to < 10.0.14393.9612)

Fixed in

• Fixed builds per the CNA ranges: Windows 10 1607 and Server 2016 10.0.14393.9612; 1809 10.0.17763.9376; 21H2 10.0.19044.7807; 11 23H2 10.0.22631.7652; 24H2 and 25H2 10.0.26100.9711 and 10.0.26200.9711; 26H1 10.0.28000.3231; 26H2 10.0.26300.9711; Server 2012 6.2.9200.26434; Server 2012 R2 6.3.9600.23470
• Windows 10 22H2: Unknown (the sources conflict; verify in the MSRC Update Guide)
• Security update KB numbers: Unknown (not verified)

Workaround

Unknown.

Exploitation

• No known exploitation at the time of research.
• Not listed in the CISA KEV catalog at the time of research.
• No public proof of concept found in the sources checked.
• EPSS is 0.01273 (low predicted exploitation probability).

Our recommendation

• Inventory all Windows hosts with IPsec, IKE, or VPN roles, especially on 10 1607, 1809, 21H2, 22H2, Server 2012, 2012 R2 and 2016.
• Apply the Microsoft security update for each affected build, after confirming the exact KB in the MSRC Update Guide.
• Prioritise internet-facing VPN and IPsec endpoints.
• If IPsec/IKE is not needed, disable the service or block UDP 500 and 4500 at the perimeter. Restrict IKE to known peers.
• Check whether Windows 10 1607 and Server 2016 are still within Microsoft's support lifecycle, and plan an upgrade if they are not.
• Monitor for KEV listing or public exploit code.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Microsoft Security Update Guide: CVE-2026-83795 msrc.microsoft.com
• Vulners NVD record CVE-2026-83795 vulners.com
• Vulners CVElist record CVE-2026-83795 vulners.com
• OpenCVE summary CVE-2026-83795 app.opencve.io
• VulDB entry 418991 vuldb.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 2 Nov 2026, 18:45.