EUVD-2026-34990
GHSA-87cf-mxjw-fmjh
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Primary rating from Vendor (VulnCheck) · only source for this CVE.
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
6DescriptionCVE.org
Comodo Internet Security's firewall driver Inspect.sys contains an integer underflow in its IPv6 packet parser. The parser decrements an unsigned 64-bit payload-length value (taken from the IPv6 fixed header's payload length field) by the size of each IPv6 extension header without validating it, so a packet whose declared payload length is smaller than the sum of its extension-header lengths underflows the value to a near-maximal 64-bit integer. Because IPv6 parsing occurs before firewall rule enforcement, a remote, unauthenticated attacker can send a single crafted IPv6 packet - even to a host with all ports blocked - to trigger an out-of-bounds read (and, on a separate code path, an oversized memcpy) in the Windows kernel at DISPATCH_LEVEL, crashing the system (BSOD).
AnalysisAI
Remote denial of service in Comodo Internet Security's Inspect.sys firewall driver lets an unauthenticated attacker crash any Windows host running the product by sending a single crafted IPv6 packet, even when all ports are blocked at the firewall. The flaw is an integer underflow (CWE-191) in IPv6 extension-header parsing that occurs before firewall rule enforcement, producing an out-of-bounds read and an oversized memcpy at DISPATCH_LEVEL and an immediate BSOD. Publicly available exploit code exists, published alongside MalwareTech's technical writeup and a working PoC named ComoDoS.
Technical ContextAI
The vulnerability lives in Inspect.sys, the kernel-mode network filter driver that backs Comodo Internet Security's host firewall. When parsing IPv6 traffic, the driver reads the 16-bit payload length field from the IPv6 fixed header into an unsigned 64-bit variable and then subtracts each IPv6 extension header's length from it without first checking that the running total remains non-negative. CWE-191 (integer underflow) applies directly: when the declared payload length is smaller than the cumulative extension-header size, the unsigned subtraction wraps to a value near 2^64, which downstream code uses as a length for an out-of-bounds read and, on a separate path, as the size argument to a kernel memcpy. Because IPv6 deconstruction happens in the driver's pre-filter pipeline (the firewall ruleset is only consulted after the packet is parsed), no policy - including a default-deny posture - can prevent the bug from being reached. The faulting code runs at IRQL DISPATCH_LEVEL, where any access violation immediately bugchecks the kernel. CPE data scopes impact to cpe:2.3:a:comodo:comodo_internet_security across all listed versions.
RemediationAI
No vendor-released patch identified at time of analysis from the supplied data - there is no Comodo advisory URL or fixed version in the references, so administrators should monitor Comodo's product channels and the VulnCheck advisory (https://www.vulncheck.com/advisories/comodo-internet-security-inspect-sys-ipv6-integer-underflow-remote-denial-of-service) for an updated Inspect.sys build. Until a patched driver ships, the most effective compensating control is to drop or filter inbound IPv6 traffic - including IPv6 extension-header-bearing packets - at an upstream device (perimeter firewall, switch ACL, or the host's NIC) before it reaches Inspect.sys, accepting the trade-off that any legitimate IPv6 connectivity on the host will be broken. Disabling IPv6 on affected Windows interfaces achieves the same protection at the cost of breaking IPv6-dependent services, link-local discovery, and some Windows networking features that prefer IPv6. Where neither is acceptable, isolating affected endpoints to network segments that do not carry untrusted IPv6 traffic reduces exposure but does not eliminate it from peer hosts. Treat MalwareTech's writeup (https://malwaretech.com/2026/06/exploiting-a-remote-kernel-vulnerability-in-comodo-internet-security.html) and ComoDoS PoC (https://github.com/MalwareTech/ComoDoS) as live exploit material when prioritizing.
More in Comodo Internet Security
View allAn issue was discovered in signmgr.dll 6.5.0.819 in Comodo Internet Security through 12.0. Rated high severity (CVSS 7.8
Comodo Internet Security before 5.10.228257.2253 on Windows 7 x64 allows local users to cause a denial of service (syste
Same weakness CWE-191 – Integer Underflow
View allSame technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today