Remote DoS in Comodo Internet Security Inspect.sys IPv6 Parser

CVE-2026-49494 is an integer underflow vulnerability in Comodo Internet Security's firewall driver, Inspect.sys, within its IPv6 packet parsing logic. The vulnerable parser subtracts the size of each IPv6 extension header from an unsigned 64-bit payload-length value derived from the IPv6 fixed header payload length field, but does not validate that the remaining length is sufficient before each decrement. If an attacker supplies an IPv6 packet whose declared payload length is smaller than the cumulative size of the included extension headers, the length value underflows to a near-maximum 64-bit integer. This corrupted length is then used in subsequent parsing paths, leading to an out-of-bounds read and, on a separate code path, an oversized memcpy in kernel context. Because this parsing occurs before firewall rule enforcement, the flaw is reachable via a single crafted IPv6 packet sent remotely and without authentication.