Comodo Internet Security CVE-2026-49494

The target must be a Windows host running Comodo Internet Security with the Inspect.sys firewall driver active and processing IPv6, and the attacker must be able to deliver a single IPv6 packet to the host's network stack - no authentication, user interaction, open port, or permissive firewall rule is required because parsing occurs before rule enforcement. The packet must declare an IPv6 fixed-header payload length smaller than the sum of its appended extension-header lengths so the unsigned 64-bit subtraction underflows. Practical limits on exploitation: the host must actually receive IPv6 traffic from the attacker's path (hosts behind upstream IPv6-dropping devices, or with IPv6 disabled on the relevant interface, are not reachable), and impact is bounded to availability (kernel crash) - there is no confirmed code execution path in the supplied data despite the oversized memcpy.

CVSS 4.0 vector AV:N/AC:L/AT:N/PR:N/UI:N with VA:H but VC:N/VI:N is internally consistent with the observed behavior: a remote, unauthenticated, no-interaction trigger that affects availability only (kernel BSOD) with no direct confidentiality or integrity loss. The 8.7 score is credible because exploitation is single-packet, pre-authentication, and pre-firewall - there is essentially no network-level mitigation short of dropping IPv6 upstream. Publicly available exploit code (MalwareTech's ComoDoS PoC plus a detailed writeup) sharply raises real-world risk, and the bug is reachable on hosts with all ports blocked, so common enterprise hardening does not help. EPSS and CISA KEV status are not provided in the input; absence of a KEV entry is not evidence of absence of exploitation, but at time of analysis there is no public confirmation of in-the-wild abuse. Net assessment: a credible, easy-to-deliver remote DoS against any reachable endpoint running Comodo Internet Security, prioritized higher than a typical DoS because the PoC is public and the firewall itself cannot block the trigger.

An attacker with any network path to a target - same LAN, a hostile Wi-Fi, or a routed IPv6 reachable internet host - sends a single crafted IPv6 packet whose fixed-header payload length is smaller than the total length of its appended extension headers. Inspect.sys parses the packet before consulting firewall rules, the unsigned 64-bit length underflows during extension-header processing, and the subsequent out-of-bounds read (or oversized memcpy) faults at DISPATCH_LEVEL and bugchecks Windows into an immediate BSOD. Because a working PoC (ComoDoS) is published, mass-scanning or repeat-crashing scripted attacks against exposed endpoints are trivially within reach.