CVE-2026-49494: Comodo Internet Security Inspect.sys IPv6 Integer Underflow Remote Denial of Service

Synopsis

An integer underflow vulnerability exists in the IPv6 packet parser inside Inspect.sys, the firewall driver bundled with Comodo Internet Security versions 12.3.4.8162 and earlier. A remote, unauthenticated attacker can send a single crafted IPv6 packet to cause an out-of-bounds read and oversized memory copy in the Windows kernel, crashing the target system with a Blue Screen of Death (BSOD). Because parsing happens before firewall rule enforcement, the crash is reachable even on hosts where all inbound ports are blocked. No upstream fix has been published; HarborGuard tracks this advisory and will make a patched-image rebuild available the moment a fix version is released.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the target over the network; a single crafted IPv6 packet sent from any remote host is sufficient to trigger the vulnerability.

• AuthenticationNot required

  No account or credentials are needed; the vulnerable parsing code executes before any authentication or firewall rule check takes place.

• Victim interactionNot required

  No action from a user on the target host is required; the crash is triggered entirely by the incoming malformed packet.

• Attack complexityDetail

  Exploit complexity is low: the attacker only needs to send one specially constructed IPv6 packet, with no race conditions or specific environmental state required.

Blast Radius

• Crashes the target Windows system immediately with a kernel-level Blue Screen of Death, taking all running processes and workloads offline.
• Causes unplanned system downtime for any host running an affected version of Comodo Internet Security, regardless of its configured firewall rules.
• Enables a persistent denial-of-service condition if the attacker continues sending crafted packets after each reboot, keeping the host unavailable indefinitely.