Windows Internet Key Exchange (IKE): Out-of-bounds read causes denial of service

Summary

An out-of-bounds read in the Windows Internet Key Exchange (IKE) component allows an unauthenticated remote attacker to crash or hang the IKE service over the network. The impact is limited to availability; no code execution or data theft is reported. Hosts with IPsec or VPN roles reachable on UDP 500 and 4500 are the relevant exposure.

Affected

• Windows 10 Version 1607 (32-bit and x64): 10.0.14393.0 to below 10.0.14393.9612
• Windows 10 Version 1809: 10.0.17763.0 to below 10.0.17763.9376
• Windows 10 Version 21H2: 10.0.19044.0 to below 10.0.19044.7807
• Windows 10 Version 22H2: 10.0.19045.0 to below 10.0.19045.7807
• Windows 11 Version 23H2: 10.0.22631.0 to below 10.0.22631.7652
• Windows 11 Version 24H2: 10.0.26100.0 to below 10.0.26100.9711
• Windows 11 Version 25H2: 10.0.26200.0 to below 10.0.26200.9711
• Windows 11 Version 26H1: 10.0.28000.0 to below 10.0.28000.3231
• Windows 11 Version 26H2: 10.0.26300.0 to below 10.0.26300.9711
• Windows Server 2012 and Server Core: 6.2.9200.0 to below 6.2.9200.26434
• Windows Server 2012 R2 and Server Core: 6.3.9600.0 to below 6.3.9600.23470
• Windows Server 2016: 10.0.14393.0 to below 10.0.14393.9612

Fixed in

• Windows 10 Version 1607 / Server 2016: 10.0.14393.9612 or later (KB number not confirmed)
• Windows 10 Version 1809: 10.0.17763.9376 or later (Tenable lists KB5126651)
• Windows 10 Version 21H2: 10.0.19044.7807 or later
• Windows 10 Version 22H2: 10.0.19045.7807 or later
• Windows 11 23H2: 10.0.22631.7652 or later
• Windows 11 24H2: 10.0.26100.9711 or later
• Windows 11 25H2: 10.0.26200.9711 or later
• Windows 11 26H1: 10.0.28000.3231 or later
• Windows 11 26H2: 10.0.26300.9711 or later
• Windows Server 2012 / 2012 R2: see MSRC for the exact build (one aggregator lists 6.2.9200.26434 and an unverified value)
• Patches are part of the October 2026 security updates. Verify the exact KB on the MSRC page.

Workaround

Unknown. No vendor workaround was found in the sources.

• If IPsec/IKE is not required on a Windows host, disable the related IPsec or VPN role or policy (interim measure, not from the vendor).
• Where IKE is required, restrict UDP 500 and 4500 at the firewall to known VPN peers (interim measure, not from the vendor).

Exploitation

• No evidence of exploitation in the wild in the sources reviewed.
• CISA SSVC (ADP): Exploitation: none; Automatable: yes; Technical Impact: partial.
• No public proof-of-concept or exploit code found.
• EPSS is low (about 0.013).

Our recommendation

• Apply the October 2026 Windows security update on all affected systems, prioritising internet-facing VPN or IPsec servers and Server 2016 / Windows 10 1607 and 1809 systems.
• Verify the exact build and KB for your version on the MSRC Security Update Guide before rollout.
• Check whether IPsec or VPN roles (for example RRAS) are enabled and reachable on UDP 500/4500; disable them if unused, otherwise restrict access to known peers.
• Confirm the end-of-support status of Windows 10 1607 on Microsoft's lifecycle pages and plan an upgrade if it is no longer supported.
• Monitor IKE service crashes and unusual traffic on UDP 500/4500.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Microsoft Security Update Guide: CVE-2026-83843 msrc.microsoft.com
• NVD record mirror (Vulners) vulners.com
• CVE list mirror (Vulners) vulners.com
• CVE record mirror (OpenCVE) app.opencve.io
• Aggregator entry (imfht) cve.imfht.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 2 Nov 2026, 18:44.