# CVE-2026-49494: Comodo Internet Security integer underflow in Inspect.sys IPv6 parser

Source: https://junglewise.ai/threats/cve-2026-49494-comodo-internet-security-integer-underflow-in-inspect-sys-ipv6  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-07. Updated: 2026-06-07  
License: CC BY 4.0 with a link back

CVE-2026-49494 · Severity: high · CVSS 7.5 · Published 2026-06-07

A vulnerability in the Comodo Internet Security firewall allows a remote attacker to crash a protected computer by sending a single specially crafted network packet. This occurs because the firewall's core driver fails to properly handle certain types of IPv6 traffic, leading to a 'Blue Screen of Death' (BSOD). Because the flaw is processed before the firewall's security rules are applied, even systems configured to block all incoming traffic are susceptible to this remote shutdown.

## Quick answers

**Is CVE-2026-49494 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-49494 being exploited in the wild.

**How severe is CVE-2026-49494?** High severity, with a CVSS score of 7.5, published 7 June 2026.

**Which products and versions are affected?** Comodo Internet Security <= 12.3.4.8162.

**Is there a fix for CVE-2026-49494?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-49494 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-49494?** Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

An integer underflow vulnerability exists in the Comodo Internet Security firewall driver, Inspect.sys, specifically within its IPv6 packet parsing logic. The parser decrements an unsigned 64-bit payload-length value (sourced from the IPv6 fixed header) by the size of each extension header without prior validation. If the declared payload length is smaller than the total size of the extension headers, the value wraps around to a near-maximal 64-bit integer. This leads to an out-of-bounds read or an oversized memcpy operation in the Windows kernel at DISPATCH_LEVEL. Since this parsing occurs before firewall rule enforcement, the attack is effective even against hosts with all ports blocked.

## Affected products

- Comodo Internet Security <= 12.3.4.8162

## Timeline

- 2026-06-07: disclosed
- 2026-06-07: advisory

## References

- [https://github.com/MalwareTech/ComoDoS](https://github.com/MalwareTech/ComoDoS)
- [https://malwaretech.com/2026/06/exploiting-a-remote-kernel-vulnerability-in-comodo-internet-security.html](https://malwaretech.com/2026/06/exploiting-a-remote-kernel-vulnerability-in-comodo-internet-security.html)
- [https://www.vulncheck.com/advisories/comodo-internet-security-inspect-sys-ipv6-integer-underflow-remote-denial-of-service](https://www.vulncheck.com/advisories/comodo-internet-security-inspect-sys-ipv6-integer-underflow-remote-denial-of-service)