Brief Summary: CVE-2026-35424 Windows IKE Protocol Memory Leak Denial of Service

Introduction

A memory leak in the Windows Internet Key Exchange (IKE) Protocol, patched in Microsoft's May 2026 Patch Tuesday cycle, allows an unauthenticated remote attacker to exhaust system memory and deny service to affected hosts. For organizations running Windows systems that process IKE traffic, particularly VPN gateways, domain controllers, and perimeter servers facing untrusted networks, this vulnerability is a straightforward path to disrupting availability, with no credentials or user interaction required.

Technical Information

Root Cause

CVE-2026-35424 stems from CWE-401: Missing Release of Memory after Effective Lifetime. The Windows IKE Protocol implementation allocates memory while processing incoming IKE packets but fails to release that memory once it is no longer needed. The leak accumulates over time as the service handles traffic.

IKE is a core part of the IPsec protocol suite and negotiates security associations for VPN tunnels and other encrypted network communications. It typically listens on UDP port 500 (and port 4500 for NAT traversal). Because IKE is a closed-source Windows binary, no source code diff is publicly available.

CVSS Metric Analysis

The vulnerability carries a CVSS 3.1 Base Score of 7.5 and a Temporal Score of 6.5. The individual metrics break down as follows:

Network reachability, low complexity, and no authentication requirement together make this vulnerability particularly relevant for systems exposed to untrusted networks.

Attack Flow

An attacker would exploit this vulnerability through resource exhaustion:

1. The attacker locates a Windows system that exposes IKE services, typically by probing UDP port 500 or port 4500.
2. It then sends specially crafted IKE packets to the target. Each packet triggers a code path in the IKE service where memory is allocated but never freed.
3. A sustained stream of these packets forces the target system to accumulate unreleased memory allocations.
4. As available system memory is consumed, the IKE service degrades. Depending on the system's memory capacity and workload, the IKE service can eventually fail entirely, and other services competing for the same memory pool may be affected.

The attack does not require valid IKE credentials or a completed security association negotiation. The memory leak is triggered during packet processing, before any authentication takes place.

Patch Information

Microsoft released an official fix for CVE-2026-35424 on May 12, 2026, as part of the May 2026 Patch Tuesday security update cycle. The MSRC advisory sets the Remediation Level to "Official Fix," and the CVE.org record tags the advisory reference as both vendor-advisory and patch. Together, these confirm that a complete vendor solution is available.

The patch corrects the IKE protocol's memory management so that allocated memory is freed once it is no longer needed, which closes the leak path. The fix ships in cumulative and security-only updates for every affected Windows version.

The table lists the Knowledge Base articles and fixed build numbers for each product family:

Several newer platforms, including Windows Server 2022, Windows Server 2025, and Windows 11 24H2/25H2, received both a standard cumulative security update and a separate Security Hotpatch Update. Hotpatching applies the fix in memory without a full system reboot, which is particularly valuable for server workloads where uptime is critical.

To verify that a system is patched, administrators should compare the OS build number (shown by winver, or by ver at a command prompt) against the fixed build numbers in the table above. Any build at or above the listed threshold for the corresponding product is protected.

Affected Systems and Versions

The patch information in the CVE.org record confirms the following Windows versions as affected:

• Windows Server 2012 and Windows Server 2012 (Server Core installation)
• Windows Server 2012 R2 and Windows Server 2012 R2 (Server Core installation)
• Windows 10 version 1607
• Windows Server 2016 and Windows Server 2016 (Server Core installation)
• Windows 10 version 1809
• Windows Server 2019 and Windows Server 2019 (Server Core installation)
• Windows 10 21H2
• Windows 10 22H2
• Windows Server 2022 and Windows Server 2022 (Server Core installation)
• Windows Server 2022, 23H2 Edition (Server Core installation)
• Windows 11 23H2
• Windows 11 24H2
• Windows 11 25H2
• Windows Server 2025 and Windows Server 2025 (Server Core installation)
• Windows 11 26H1

Any system running a build number below the fixed thresholds in the Patch Information section is vulnerable. Systems that do not have the IKE service active, or that block IKE traffic at the network perimeter, have reduced exposure but should still be patched.

Vendor Security History

Microsoft ships security updates on a predictable monthly cadence. The May 2026 Patch Tuesday release fixed a large number of security flaws, though the reported total differs by source:

No zero-day vulnerabilities were reported in this cycle, so administrators have a stable window to test and deploy fixes through standard change management procedures. Windows is also widely deployed. Windows 11 alone held approximately 72.78 percent market share as of February 2026, so vulnerabilities in core networking components like IKE carry significant aggregate risk across the installed base.

References

• MSRC Advisory: CVE-2026-35424
• NVD Entry: CVE-2026-35424
• CVE.org Record: CVE-2026-35424
• BleepingComputer: Microsoft May 2026 Patch Tuesday fixes 120 flaws, no zero days
• The Hacker News: Microsoft Patches 138 Vulnerabilities
• IT Connect: Patch Tuesday May 2026
• Windows Central: Windows 11 Market Share February 2026