Integer Underflow Vulnerability in Comodo Internet Security Firewall Driver
CVE-2026-49494

8.7HIGH

Key Information:

Vendor: Xcitium (formerly Comodo Security Solutions)
Status: Comodo Internet Security; Xcitium Client Security (xcs)
Vendor: CVE Published:; 7 June 2026

🔔 Create Xcitium (formerly Comodo Security Solutions) Vulnerability Alert

Badges

👾 Exploit Exists🟡 Public PoC

What is CVE-2026-49494?

The firewall driver Inspect.sys in Comodo Internet Security contains an integer underflow flaw within its IPv6 packet parser. This vulnerability arises when the parser improperly decrements an unsigned 64-bit payload-length value derived from the IPv6 fixed header's payload length field, without adequate validation. As a result, if the declared payload length of a packet is smaller than the cumulative length of its extension headers, it leads to an underflow of the value to a near-maximal 64-bit integer. This issue occurs prior to firewall rule enforcement, allowing attackers to exploit it by sending a specially crafted IPv6 packet to a target system, potentially resulting in an out-of-bounds read and oversized memory copy (memcpy) operation, which can crash the system, triggering a Blue Screen of Death (BSOD).

Affected Version(s)

Comodo Internet Security 0 <= 12.3.4.8162

Xcitium Client Security (XCS) 0

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2026-49494 - Proof of Concept