PT-2026-47183 · Comodo · Comodo Internet Security

Marcus Hutchins · Published 2026-06-07 · Updated 2026-06-07 · CVE-2026-49494

Mitre

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Comodo Internet Security's firewall driver Inspect.sys contains an integer underflow in its IPv6 packet parser. The parser decrements an unsigned 64-bit payload-length value (taken from the IPv6 fixed header's payload length field) by the size of each IPv6 extension header without validating it, so a packet whose declared payload length is smaller than the sum of its extension-header lengths underflows the value to a near-maximal 64-bit integer. Because IPv6 parsing occurs before firewall rule enforcement, a remote, unauthenticated attacker can send a single crafted IPv6 packet - even to a host with all ports blocked - to trigger an out-of-bounds read (and, on a separate code path, an oversized memcpy) in the Windows kernel at DISPATCH LEVEL, crashing the system (BSOD).

Exploit

Fix

Integer Underflow

Weakness Enumeration

CWE-191

Related Identifiers

CVE-2026-49494

Affected Products

Comodo Internet Security

References · 4

• 🔥 https://github.com/MalwareTech/ComoDoS · Exploit
• 🔥 https://malwaretech.com/2026/06/exploiting-a-remote-kernel-vulnerability-in-comodo-internet-security.html · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-49494 · Security Note
• https://vulncheck.com/advisories/comodo-internet-security-inspect-sys-ipv6-integer-underflow-remote-denial-of-service · Note