Executive brief
A vulnerability in the Comodo Internet Security firewall allows a remote attacker to crash a protected computer by sending a single specially crafted network packet. This occurs because the firewall's core driver fails to properly handle certain types of IPv6 traffic, leading to a 'Blue Screen of Death' (BSOD). Because the flaw is processed before the firewall's security rules are applied, even systems configured to block all incoming traffic are susceptible to this remote shutdown.
Technical details
An integer underflow vulnerability exists in the Comodo Internet Security firewall driver, Inspect.sys, specifically within its IPv6 packet parsing logic. The parser decrements an unsigned 64-bit payload-length value (sourced from the IPv6 fixed header) by the size of each extension header without prior validation. If the declared payload length is smaller than the total size of the extension headers, the value wraps around to a near-maximal 64-bit integer. This leads to an out-of-bounds read or an oversized memcpy operation in the Windows kernel at DISPATCH_LEVEL. Since this parsing occurs before firewall rule enforcement, the attack is effective even against hosts with all ports blocked.
Affected products
- Comodo Internet Security <= 12.3.4.8162
Timeline
- 2026-06-07: disclosed
- 2026-06-07: advisory