Title: Comodo Internet Security de Comodo, Description: El controlador de cortafuegos de Comodo Internet Security, Inspect.sys, contiene un desbordamiento negativo de enteros en su analizador de paquetes IPv6. El analizador decrementa un valor de longitud de carga útil sin signo de 64 bits (tomado del campo de longitud de carga útil del encabezado fijo IPv6) por el tamaño de cada encabezado de extensión IPv6 sin validarlo, por lo que un paquete cuya longitud de carga útil declarada es menor que la suma de las longitudes de sus encabezados de extensión provoca un desbordamiento negativo del valor a un entero de 64 bits casi máximo. Debido a que el análisis de IPv6 ocurre antes de la aplicación de las reglas de cortafuegos, un atacante remoto no autenticado puede enviar un único paquete IPv6 manipulado - incluso a un host con todos los puertos bloqueados - para activar una lectura fuera de límites (y, en una ruta de código separada, un memcpy de tamaño excesivo) en el kernel de Windows en DISPATCH_LEVEL, lo que provoca el bloqueo del sistema (BSOD).

Comodo Internet Security's firewall driver Inspect.sys contains an integer underflow in its IPv6 packet parser. The parser decrements an unsigned 64-bit payload-length value (taken from the IPv6 fixed header's payload length field) by the size of each IPv6 extension header without validating it, so a packet whose declared payload length is smaller than the sum of its extension-header lengths underflows the value to a near-maximal 64-bit integer. Because IPv6 parsing occurs before firewall rule enforcement, a remote, unauthenticated attacker can send a single crafted IPv6 packet - even to a host with all ports blocked - to trigger an out-of-bounds read (and, on a separate code path, an oversized memcpy) in the Windows kernel at DISPATCH_LEVEL, crashing the system (BSOD).

Xcitium Client Security (XCS) before 13.8.2.10019 and Comodo Internet Security (CIS) through 12.3.4.8162 (fix expected by 2026 Q3) contain an integer underflow vulnerability in the firewall driver Inspect.sys that allows remote unauthenticated attackers to crash the system by sending a crafted IPv6 packet with a declared payload length smaller than the sum of its extension-header lengths. The unsigned 64-bit payload-length value underflows to a near-maximal integer, triggering an out-of-bounds read and oversized memcpy in the Windows kernel at DISPATCH_LEVEL, resulting in a blue screen of death even on hosts with all ports blocked.

https://updates.xcitium.com/#note11312

https://www.vulncheck.com/advisories/xcitium-client-security-comodo-internet-security-remote-dos

https://www.vulncheck.com/advisories/comodo-internet-security-inspect-sys-ipv6-integer-underflow-remote-denial-of-service

[{"vendor":"Comodo","product":"Comodo Internet Security","defaultStatus":"unaffected","modules":["Inspect.sys"],"versions":[{"version":"0","lessThanOrEqual":"12.3.4.8162","versionType":"custom","status":"affected"}]}]

[{"vendor":"Xcitium (formerly Comodo Security Solutions)","product":"Comodo Internet Security","defaultStatus":"unaffected","modules":["Inspect.sys"],"versions":[{"version":"0","lessThanOrEqual":"12.3.4.8162","versionType":"custom","status":"affected"}]},{"vendor":"Xcitium","product":"Xcitium Client Security (XCS)","defaultStatus":"affected","versions":[{"version":"0","lessThan":"13.8.2.10019","versionType":"custom","status":"affected"}]}]

{"timestamp":"2026-06-08T15:16:19.372196Z","id":"CVE-2026-49494","options":[{"exploitation":"poc"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}

[{"vendor":"Comodo","product":"Comodo Internet Security","defaultStatus":"unaffected","modules":["Inspect.sys"],"versions":[{"version":"0","lessThanOrEqual":"12.3.4.8162","versionType":"custom","status":"affected"}]}]

Comodo Internet Security's firewall driver Inspect.sys contains an integer underflow in its IPv6 packet parser. The parser decrements an unsigned 64-bit payload-length value (taken from the IPv6 fixed header's payload length field) by the size of each IPv6 extension header without validating it, so a packet whose declared payload length is smaller than the sum of its extension-header lengths underflows the value to a near-maximal 64-bit integer. Because IPv6 parsing occurs before firewall rule enforcement, a remote, unauthenticated attacker can send a single crafted IPv6 packet - even to a host with all ports blocked - to trigger an out-of-bounds read (and, on a separate code path, an oversized memcpy) in the Windows kernel at DISPATCH_LEVEL, crashing the system (BSOD).

AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CWE-191

https://github.com/MalwareTech/ComoDoS

https://malwaretech.com/2026/06/exploiting-a-remote-kernel-vulnerability-in-comodo-internet-security.html

https://www.vulncheck.com/advisories/comodo-internet-security-inspect-sys-ipv6-integer-underflow-remote-denial-of-service