Comodo Internet Security's firewall driver Inspect.sys contains an integer underflow in its IPv6 packet parser. The parser decrements an unsigned 64-bit payload-length value (taken from the IPv6 fixed header's payload length field) by the size of each IPv6 extension header without validating it, so a packet whose declared payload length is smaller than the sum of its extension-header lengths underflows the value to a near-maximal 64-bit integer. Because IPv6 parsing occurs before firewall rule enforcement, a remote, unauthenticated attacker can send a single crafted IPv6 packet - even to a host with all ports blocked - to trigger an out-of-bounds read (and, on a separate code path, an oversized memcpy) in the Windows kernel at DISPATCH_LEVEL, crashing the system (BSOD).
Comodo Internet Security Inspect.sys IPv6 Integer Underflow Remote Denial of Service
Problem type
Affected products
Comodo
<= 12.3.4.8162 - AFFECTED
References
https://malwaretech.com/2026/06/exploiting-a-remote-kernel-vulnerability-in-comodo-internet-security.html
https://github.com/MalwareTech/ComoDoS
https://www.vulncheck.com/advisories/comodo-internet-security-inspect-sys-ipv6-integer-underflow-remote-denial-of-service
GitHub Security Advisories
GHSA-87cf-mxjw-fmjh
Comodo Internet Security's firewall driver Inspect.sys contains an integer underflow in its IPv6...
https://github.com/advisories/GHSA-87cf-mxjw-fmjhComodo Internet Security's firewall driver Inspect.sys contains an integer underflow in its IPv6 packet parser. The parser decrements an unsigned 64-bit payload-length value (taken from the IPv6 fixed header's payload length field) by the size of each IPv6 extension header without validating it, so a packet whose declared payload length is smaller than the sum of its extension-header lengths underflows the value to a near-maximal 64-bit integer. Because IPv6 parsing occurs before firewall rule enforcement, a remote, unauthenticated attacker can send a single crafted IPv6 packet - even to a host with all ports blocked - to trigger an out-of-bounds read (and, on a separate code path, an oversized memcpy) in the Windows kernel at DISPATCH_LEVEL, crashing the system (BSOD).
https://nvd.nist.gov/vuln/detail/CVE-2026-49494
https://github.com/MalwareTech/ComoDoS
https://malwaretech.com/2026/06/exploiting-a-remote-kernel-vulnerability-in-comodo-internet-security.html
https://www.vulncheck.com/advisories/comodo-internet-security-inspect-sys-ipv6-integer-underflow-remote-denial-of-service
https://github.com/advisories/GHSA-87cf-mxjw-fmjh
JSON source
https://cveawg.mitre.org/api/cve/CVE-2026-49494Click to expand
{
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"cveMetadata": {
"cveId": "CVE-2026-49494",
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"dateUpdated": "2026-06-07T12:08:59.492Z",
"dateReserved": "2026-05-31T11:54:34.993Z",
"datePublished": "2026-06-07T12:08:59.492Z",
"state": "PUBLISHED"
},
"containers": {
"cna": {
"providerMetadata": {
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck",
"dateUpdated": "2026-06-07T12:08:59.492Z"
},
"datePublic": "2026-06-03T00:00:00.000Z",
"title": "Comodo Internet Security Inspect.sys IPv6 Integer Underflow Remote Denial of Service",
"descriptions": [
{
"lang": "en",
"value": "Comodo Internet Security's firewall driver Inspect.sys contains an integer underflow in its IPv6 packet parser. The parser decrements an unsigned 64-bit payload-length value (taken from the IPv6 fixed header's payload length field) by the size of each IPv6 extension header without validating it, so a packet whose declared payload length is smaller than the sum of its extension-header lengths underflows the value to a near-maximal 64-bit integer. Because IPv6 parsing occurs before firewall rule enforcement, a remote, unauthenticated attacker can send a single crafted IPv6 packet - even to a host with all ports blocked - to trigger an out-of-bounds read (and, on a separate code path, an oversized memcpy) in the Windows kernel at DISPATCH_LEVEL, crashing the system (BSOD)."
}
],
"affected": [
{
"vendor": "Comodo",
"product": "Comodo Internet Security",
"modules": [
"Inspect.sys"
],
"defaultStatus": "unaffected",
"versions": [
{
"version": "0",
"status": "affected",
"versionType": "custom",
"lessThanOrEqual": "12.3.4.8162"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"lang": "en",
"description": "Integer Underflow (Wrap or Wraparound)",
"cweId": "CWE-191",
"type": "CWE"
}
]
}
],
"references": [
{
"url": "https://malwaretech.com/2026/06/exploiting-a-remote-kernel-vulnerability-in-comodo-internet-security.html",
"name": "MalwareTech - ComoDoS",
"tags": [
"technical-description",
"exploit"
]
},
{
"url": "https://github.com/MalwareTech/ComoDoS",
"name": "Proof of Concept",
"tags": [
"exploit"
]
},
{
"url": "https://www.vulncheck.com/advisories/comodo-internet-security-inspect-sys-ipv6-integer-underflow-remote-denial-of-service",
"name": "VulnCheck Advisory: Comodo Internet Security Inspect.sys IPv6 Integer Underflow Remote Denial of Service",
"tags": [
"third-party-advisory"
]
}
],
"metrics": [
{
"format": "CVSS"
},
{
"format": "CVSS",
"cvssV3_1": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH"
}
}
],
"credits": [
{
"lang": "en",
"value": "Marcus Hutchins (MalwareTech)",
"type": "finder"
}
]
}
}
}