Loading story…
A researcher disclosed an unpatched zero-day in Comodo Internet Security’s Inspect.sys firewall driver that allows a remote, unauthenticated attacker to crash affected Windows systems with a single crafted IPv6 packet. The flaw, tracked as CVE-2026-49494 and dubbed ComoDoS, stems from an integer underflow in the driver’s IPv6 extension-header parsing logic: the code subtracts extension-header sizes from an unsigned payload-length value without verifying that the declared IPv6 payload is large enough. Because packet parsing occurs before firewall rule enforcement, the attack can succeed even when all inbound ports are blocked.
Public reporting said the bug can lead to out-of-bounds read conditions and an oversized memcpy in kernel context at DISPATCH_LEVEL, reliably triggering a blue screen of death. The researcher said remote code execution appears unlikely because the reachable write path results in an unavoidable 4 GB copy that crashes the host, but a proof of concept was released on GitHub after Comodo allegedly failed to respond to multiple disclosure attempts. At publication, no vendor patch was available, and defenders were advised to watch for anomalous IPv6 traffic and block malformed IPv6 extension headers where possible.
See affected versions and whether adversaries are exploiting it.
3 events from the most recent confirmed update back to the earliest known activity.
Advisories published for CVE-2026-49494 described an integer underflow in Comodo Internet Security's Inspect.sys IPv6 parser that can be exploited remotely with a single crafted packet. The advisories noted the bug can cause out-of-bounds read behavior or an oversized memcpy in kernel context, leading to a system crash or BSOD.
A proof-of-concept exploit for the ComoDoS vulnerability was published publicly on GitHub. The PoC demonstrated the remote denial-of-service condition against the vulnerable Inspect.sys IPv6 parsing logic.
Marcus Hutchins disclosed an unpatched zero-day in Comodo Internet Security's Inspect.sys firewall driver that allows a remote attacker to crash Windows systems with a single crafted IPv6 packet. The write-up said Comodo had not responded to the vulnerability report or follow-up emails and that no patch was available at disclosure time.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
4 references tracked. Mallory keeps watching after this page renders.
cvefeed.io
Open sourcevulncheck.com
Open sourcecybersecuritynews.com
Open sourcemalwaretech.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A flaw in the Linux kernel's netfilter `ip6t_eui64` component, tracked as **CVE-2026-31685**, allowed specially crafted IPv6 packets to trigger access to an invalid MAC header and potentially crash vulnerable systems. The bug was in `eui64_mt6()`, where the code could still call `eth_hdr(skb)` when the packet's MAC header was invalid if the fragment offset was zero, creating a remote denial-of-service condition during IPv6 packet processing. The issue affected code dating back to Linux kernel **2.6.12** and was fixed by rejecting invalid MAC headers for all packets before Ethernet header access. Upstream fixes were released across several stable kernel branches, including **6.12.83**, **6.18.24**, **6.19.14**, and **7.0**, while Red Hat shipped patches through security errata for multiple **RHEL 7, 8, 9, and 10** product variants. Red Hat rated the flaw **Moderate** with a **CVSS 7.1** for its products, although **cve.org** listed a **9.4** score, and both upstream and vendor guidance advised updating to the latest supported kernel packages.
Aug 25, 2026
A public proof-of-concept exploit has been released for **CVE-2026-42980**, a high-severity Windows NT OS Kernel elevation-of-privilege flaw that allows a locally authenticated low-privileged user to gain **`NT AUTHORITY\SYSTEM`** access. The vulnerability stems from an integer underflow in the kernel's WMI serialization code that can trigger a heap-based buffer overflow and kernel memory corruption on supported Windows client and server releases, including Windows 10 Version 1607 and later builds. Microsoft patched the issue in its June 2026 Patch Tuesday updates, assigned it a **CVSS 3.1 score of `7.8`**, and assessed exploitation as **"more likely."** While there is no confirmed in-the-wild exploitation reported so far, the availability of exploit code raises the risk that attackers could use the bug after initial compromise to obtain full machine control, particularly on shared systems and servers. Microsoft has not provided a configuration workaround, making prompt deployment and validation of the June 2026 cumulative updates the primary mitigation.
Jul 23, 2026
Microsoft patched **`CVE-2026-47291`**, a remotely exploitable flaw in **Windows `HTTP.sys`** that can cause denial of service or potentially **kernel-level remote code execution** on systems using the HTTP protocol stack behind IIS and other applications. The bug stems from an **integer overflow** while `HTTP.sys` expands a per-request buffer reference array during **HTTP/1.x header parsing over TLS**; the array's 16-bit capacity can wrap to zero, leading to a large **kernel pool heap buffer overflow** during memory movement operations. Exploitation requires a remote, unauthenticated attacker to send a specially crafted **HTTPS** request with many header lines, placing each header in a separate **TLS application data record** so each becomes a distinct buffer reference. The issue is described as reachable only on the **HTTP/1.x over TLS** path, not the HTTP/2 or HTTP/3 parser paths, and it depends on the target accepting an unusually large request; keeping the **`MaxRequestBytes`** registry setting at or below **65,535 bytes** is cited as a practical mitigation, while applying Microsoft's June 2026 patch is the recommended fix. Detection guidance includes inspecting decrypted HTTPS traffic for excessive HTTP/1.x header lines or, without decryption, looking for sustained connections carrying many small TLS application data records.
Jul 11, 2026