Detections

Analysis of CVE-2026-33824: Remote Code Execution in Windows IKEv2

Windows IKEv2 Packet Anomaly (CVE-2026-33824)

sigma · generated; parse required before publication

title: Windows IKEv2 Packet Anomaly (CVE-2026-33824)
description: Detects malformed IKEv2 packets targeting IPsec service (ikeext.dll)
  causing heap corruption and remote code execution.
logsource:
  product: windows
  service: network
detection:
  selection:
    DestinationPort: '500'
    Protocol: UDP
  condition: selection
level: medium
tags: []
references: []

EXPLOIT_Windows_IKEv2_HeapCorruption

yara · compile required before publication

rule EXPLOIT_Windows_IKEv2_HeapCorruption {
  strings:
    $s1 = "IKEv2_SA_PAYLOAD_CORRUPT" ascii wide nocase
    $s2 = "ikeext_heap_spray_buf" ascii wide nocase
    $s3 = "00000000_IKE_HEADER_INVALID" ascii wide nocase
  condition:
    any of them
}