Comodo Internet Security up to 12.3.4.8162 Inspect.sys integer underflow

Summaryinfo

A vulnerability was found in Comodo Internet Security up to 12.3.4.8162. It has been declared as critical. Affected by this vulnerability is an unknown functionality in the library Inspect.sys. Such manipulation leads to integer underflow. This vulnerability is documented as CVE-2026-49494. The attack can be executed remotely. Additionally, an exploit exists. It is recommended to upgrade the affected component.

Detailsinfo

A vulnerability was found in Comodo Internet Security up to 12.3.4.8162. It has been rated as critical. Affected by this issue is some unknown processing in the library Inspect.sys. The manipulation with an unknown input leads to a integer underflow vulnerability. Using CWE to declare the problem leads to CWE-191. The product subtracts one value from another, such that the result is less than the minimum allowable integer value, which produces a value that is not equal to the correct result. Impacted is availability. CVE summarizes:

Comodo Internet Security's firewall driver Inspect.sys contains an integer underflow in its IPv6 packet parser. The parser decrements an unsigned 64-bit payload-length value (taken from the IPv6 fixed header's payload length field) by the size of each IPv6 extension header without validating it, so a packet whose declared payload length is smaller than the sum of its extension-header lengths underflows the value to a near-maximal 64-bit integer. Because IPv6 parsing occurs before firewall rule enforcement, a remote, unauthenticated attacker can send a single crafted IPv6 packet - even to a host with all ports blocked - to trigger an out-of-bounds read (and, on a separate code path, an oversized memcpy) in the Windows kernel at DISPATCH_LEVEL, crashing the system (BSOD).

The weakness was released by Marcus Hutchins. The advisory is shared for download at malwaretech.com. This vulnerability is handled as CVE-2026-49494 since 05/31/2026. The exploitation is known to be easy. The attack may be launched remotely. No form of authentication is required for exploitation. Technical details as well as a public exploit are known.

The exploit is available at malwaretech.com. It is declared as proof-of-concept.

Upgrading eliminates this vulnerability.

The vulnerability is also documented in the vulnerability database at EUVD (EUVD-2026-34990). Once again VulDB remains the best source for vulnerability data.

Productinfo

Vendor

• Comodo

Name

• Internet Security

Version

• 12.3.4.8162

CPE 2.3info

• 🔒

CPE 2.2info

• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion