CVE-2026-49494: Comodo Internet Security DoS Vulnerability

CVE-2026-49494 Overview

CVE-2026-49494 is an integer underflow vulnerability [CWE-191] in Inspect.sys, the firewall driver shipped with Comodo Internet Security. The driver's IPv6 packet parser decrements an unsigned 64-bit payload-length value by each extension header size without validating the result. A crafted IPv6 packet whose declared payload length is smaller than the sum of its extension headers underflows this counter to a near-maximal 64-bit integer. Because IPv6 parsing runs before firewall rule enforcement, a remote unauthenticated attacker can reach the vulnerable code path even on a host with all ports blocked. The result is an out-of-bounds read and an oversized memcpy executed in the Windows kernel at DISPATCH_LEVEL, producing a system crash (BSOD).

Critical Impact
A single crafted IPv6 packet can crash any reachable Windows host running Comodo Internet Security, regardless of firewall policy.

Affected Products

Comodo Internet Security (firewall driver Inspect.sys)
Windows endpoints running the vulnerable Comodo IPv6 packet parser
Any host reachable over IPv6 with the Comodo firewall driver loaded

Discovery Timeline

2026-06-07 - CVE-2026-49494 published to the National Vulnerability Database (NVD)
2026-06-08 - Last updated in NVD database

Technical Details for CVE-2026-49494

Vulnerability Analysis

The vulnerability resides in the IPv6 extension-header processing loop inside Inspect.sys. The parser reads the 16-bit payload length field from the IPv6 fixed header and stores it in an unsigned 64-bit variable. For every extension header it encounters, it subtracts the extension header's length from this counter before moving to the next header. The driver performs no signed comparison or bounds check before each subtraction.

When the declared payload length is smaller than the cumulative extension header length, the subtraction wraps around the unsigned 64-bit value. The counter becomes a number close to 0xFFFFFFFFFFFFFFFF. The parser then treats this enormous value as the remaining buffer size. One downstream code path uses the value as a read bound, producing an out-of-bounds read. A separate path passes the value to memcpy, producing a copy of effectively unbounded length.

Root Cause

The root cause is missing input validation on attacker-controlled length arithmetic in kernel context. The parser trusts the 16-bit payload length field from the network and never verifies the invariant that extension-header consumption must not exceed the declared payload. Because the buggy code runs at DISPATCH_LEVEL, any access violation aborts the system rather than terminating a user process.

Attack Vector

Exploitation requires no authentication, no user interaction, and no open ports. An attacker sends one crafted IPv6 packet to the victim. The Comodo driver intercepts the packet before the host's firewall policy is evaluated, so blocking inbound traffic does not prevent the bug from triggering. The crafted packet uses a small Payload Length value combined with one or more IPv6 extension headers whose summed lengths exceed it. Public technical details and a proof-of-concept are available in the MalwareTech Exploit Analysis and the GitHub PoC Repository.

Detection Methods for CVE-2026-49494

Indicators of Compromise

Unexpected Windows bugchecks referencing Inspect.sys in the kernel memory dump stack trace
Inbound IPv6 packets with a Payload Length header value smaller than the cumulative length of present extension headers
Repeated host unreachability or BSOD reboots correlated with IPv6 traffic from a single external source

Detection Strategies

Inspect IPv6 traffic at network sensors for malformed extension-header chains where the declared payload length is less than the sum of extension-header lengths.
Collect Windows minidumps from endpoints running Comodo Internet Security and flag crashes whose faulting module is Inspect.sys.
Correlate BSOD events with preceding inbound IPv6 flows to identify targeted denial-of-service attempts.

Monitoring Recommendations

Alert on Windows Event ID 1001 (BugCheck) entries that name the Comodo firewall driver.
Forward IPv6 flow telemetry to a central data lake and hunt for malformed extension-header patterns.
Track repeated unscheduled reboots across endpoints to identify wormable or scripted exploitation attempts.

How to Mitigate CVE-2026-49494

Immediate Actions Required

Apply any fixed version of Comodo Internet Security as soon as the vendor publishes a patched Inspect.sys.
Block inbound IPv6 traffic at the perimeter for hosts that do not require external IPv6 connectivity.
Restrict IPv6 extension headers at routers and switches that support filtering, dropping packets with anomalous header chains.

Patch Information

No vendor advisory URL is listed in the NVD record at the time of publication. Refer to the VulnCheck Security Advisory for the current patch status and to Comodo product update channels for fixed releases of Inspect.sys.

Workarounds

Disable the IPv6 protocol stack on Windows endpoints where IPv6 is not required.
Uninstall or disable the Comodo firewall driver until a fixed build is available, accepting the loss of host firewall coverage.
Deploy upstream network ACLs that drop IPv6 packets containing more than a minimal, expected set of extension headers.

bash

# Disable IPv6 on a Windows host as a temporary workaround
reg add "HKLM\SYSTEM\CurrentControlSet\Services\Tcpip6\Parameters" /v DisabledComponents /t REG_DWORD /d 0xFF /f
# Reboot required for the change to take effect
shutdown /r /t 0