CVE-2025-7096: comodo internet_security

Vulnerability summary

CVE-2025-7096 is a critical (CVSS 9.2) vulnerability in comodo internet_security. EPSS estimates a 0.48% chance of exploitation in the next 30 days, higher than 40% of scored vulnerabilities. 2 public exploits are recorded.

Timeline

1. 06-07-2025
   PublishedVulnerability first disclosed.
2. 07-07-2025
   Last modifiedVulnerability information updated.

Description

A vulnerability classified as critical was found in Comodo Internet Security Premium 12.3.4.8162. This vulnerability affects unknown code of the file cis_update_x64.xml of the component Manifest File Handler. The manipulation leads to improper validation of integrity check value. The attack can be initiated remotely. The complexity of an attack is rather high. The exploitation appears to be difficult. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

• CWE-345Insufficient Verification of Data AuthenticityThe product does not sufficiently verify the origin or authenticity of data, in a way that causes it to accept invalid data.
• CWE-354Improper Validation of Integrity Check ValueThe product does not validate or incorrectly validates the integrity check values or "checksums" of a message. This may prevent it from detecting if the data has been modified or corrupted in transmission.