CVE-2026-49494 Comodo CVE debrief

Who should care

Users of Comodo Internet Security are advised to apply patches or mitigations to prevent exploitation of this vulnerability.

Technical summary

The Inspect.sys driver in Comodo Internet Security contains an integer underflow vulnerability in its IPv6 packet parser. The parser incorrectly decrements an unsigned 64-bit payload-length value from the IPv6 fixed header's payload length field by the size of each IPv6 extension header without validation. A crafted IPv6 packet with a declared payload length smaller than the sum of its extension-header lengths can underflow the value to a near-maximal 64-bit integer. This occurs before firewall rule enforcement, allowing a remote attacker to trigger an out-of-bounds read and oversized memcpy in the Windows kernel at DISPATCH_LEVEL, resulting in a system crash (BSOD).

Defensive priority

HIGH

Recommended defensive actions

• Apply patches or updates provided by Comodo Internet Security to address the vulnerability in Inspect.sys.
• Implement network filtering to block suspicious IPv6 packets.
• Monitor system logs for signs of exploitation attempts.

Evidence notes

Vendor and product information is not definitively known. The CVE record and NVD detail pages provide additional context.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.