# CVE-2026-35424 — Windows IKE Protocol `ikeext.dll` Main-Mode Attribute Buffer Leak → Memory-Exhaustion Denial of Service

---

## Summary

| | |
|---|---|
| **Product** | Windows — `ikeext.dll` (IKE and AuthIP IPsec Keying Modules / Internet Key Exchange) |
| **CVE ID** | CVE-2026-35424 |
| **Impact** | Denial of Service |
| **MSRC severity** | Important |
| **CVSS** | 7.5 / 6.5 — `CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C` |
| **CWE** | CWE-401: Missing Release of Memory after Effective Lifetime (memory leak) |
| **Delivery** | Network — unauthenticated IKE Main-Mode negotiation traffic |
| **KB / Fixed build** | KB5089549 — `ikeext.dll` 10.0.26100.8457 (Win11 24H2 x64) |
| **Patch Date** | May 12, 2026 (2026-May) |
| **Pre-patch binary** | `ikeext.dll` 10.0.26100.8328 — SHA256 `830d809edbcd972cc48a25670e287a3f11c37e096dd5623257bf8afd86b6eb3c` |
| **Post-patch binary** | `ikeext.dll` 10.0.26100.8457 — SHA256 `2960e3ffce29eb46d71abb9edd01791efeac6c2e59d29a692c98869e9153cd77` |
| **Feature flag** | `Feature_1865663801` — **the fix is CFR-gated** |
| **Exploitability** | Exploitation Unlikely; not publicly disclosed; not exploited (per MSRC) |

---

## Product Description

`ikeext.dll` is the **IKEEXT** service — the IKE and AuthIP IPsec Keying Modules
that negotiate IPsec security associations. During IKE Main-Mode (MM) negotiation,
`IkeParseMMAttributes` parses the SA transform/attribute payload of an incoming IKE
packet, copying incoming attribute data (via `IkeCopyIncomingDataQuiet`) into a
work buffer referenced from its attribute structure. Buffers are released with
`WfpMemFree`.

---

## Vulnerability Summary

Pre-patch, when `IkeParseMMAttributes` copied the incoming Main-Mode attribute data
into its work buffer and then hit a parse/validation **error return path**, it
returned via `IkeReturnError` **without freeing** that buffer — a missing release of
memory after its effective lifetime (CWE-401). Because IKE processes negotiation
packets **over the network without authentication** (`AV:N`, `PR:N`), an attacker can
repeatedly send crafted Main-Mode packets that each leak the buffer, driving the
IKEEXT service toward **memory exhaustion and denial of service** (`A:H`).

---

## Prerequisites and Constraints

- Network, unauthenticated (`AV:N`, `AC:L`, `PR:N`, `UI:N`): send IKE Main-Mode
  negotiation packets to the target.
- Each crafted packet drives `IkeParseMMAttributes` down the error return path after
  the incoming attribute buffer has been allocated/copied.
- Result: the attribute buffer is leaked per request → cumulative memory exhaustion.

---

## Vulnerability Details

### Root Cause

`IkeParseMMAttributes` allocated/copied the incoming Main-Mode attribute buffer
(referenced from the attribute structure at `param_2 + 0xc`) but did not free it on
the error/return path, so every request that reached that path leaked the buffer.

### The patch (confirmed — diff, .8328 → .8457)

The diff shows `IkeParseMMAttributes` as the code-changed function. Gated behind
`Feature_1865663801`, the fix **frees the attribute buffer with `WfpMemFree` before
returning the error**:

```c
// IkeParseMMAttributes (10.0.26100.8457) — PATCHED (from the diff)
if ((Feature_1865663801__private_featureState & 0x10) == 0) {
    Feature_1865663801__private_IsEnabled();
    WfpMemFree((longlong *)(param_2 + 0xc));      // *** NEW: release the incoming attribute buffer ***
}
IkeReturnError(uVar5, "IkeParseMMAttributes", param_3, param_4);
```

Pre-patch, the corresponding path fell straight through to `IkeReturnError` with the
buffer at `param_2 + 0xc` still allocated. With the added `WfpMemFree` on the return
path, the buffer is released on every exit, so repeated Main-Mode packets no longer
accumulate leaked memory — closing the exhaustion DoS.

### Patch Completeness Assessment

**CFR-gated behind `Feature_1865663801`.** The buffer-release path runs only when the
flag is enabled; the original leaking path still ships when disabled. Verify
`Feature_1865663801` is enabled to confirm the fix is live.

---

## Detection Guidance

**Behavioural.** Sustained, unexplained non-paged/pool growth in the IKEEXT service
(`svchost` hosting `ikeext.dll`) correlated with inbound IKE (UDP/500, UDP/4500)
Main-Mode negotiation traffic; repeated malformed/failed Main-Mode SA negotiations
from the same peer on unpatched/flag-disabled builds.

**Config.** The fix is CFR-gated — confirm `Feature_1865663801` is enabled. Restrict
IKE/IPsec (UDP 500/4500) exposure to untrusted networks.

---

## References

- MSRC advisory — CVE-2026-35424 (Windows Internet Key Exchange (IKE) Protocol Denial of Service), released 2026-05-12, KB5089549.
- Full binary diff: `/data/patch_diffs/ikeext_dll-cve-2026-35424-ghidriff.md`