A heap-based buffer overflow exists in the Windows IKE Extension. An unauthenticated network attacker can trigger the overflow, causing the IKE service to crash and resulting in a denial of service for IPsec and VPN connections. The failure can affect the availability of VPN endpoints and any services that depend on secure tunnels. The underlying weakness corresponds to CWE‑122 and CWE‑125.

Microsoft Windows 10 versions 1607, 1809, 21H2 and 22H2; Microsoft Windows 11 versions 23H2, 24H2, 25H2, 26H2, 23H2, and 26H1; Microsoft Windows Server 2012, 2012 R2, 2016, 2019, 2022, and 2025, all including the Server Core installations. These systems host the IKE Extension and are susceptible when the discussed vulnerability is present.

The CVSS score of 7.5 indicates high severity. The EPSS score of 1% suggests a low but nonzero probability of exploitation in the wild, and the vulnerability is not listed in CISA’s KEV catalog. An attacker can exploit the flaw from the network side by sending a specially crafted IKE packet, requiring no privileged access. The likely attack vector is directly over the Internet or corporate network to the IKE service, posing a significant risk to organizations that rely on IPsec VPNs for remote connectivity.