CVE-2026-58058

MEDIUM

Nmap - Integer Underflow in IPv6 Extension Header Parsing

Title source: cna
STIX 2.1

Description

Nmap through 7.99 does not keep the IPv6 extension-header walk within the captured packet in ipv6_get_data_primitive (libnetutil/netutil.cc), so the pointer advances past the buffer and the remaining-length computation underflows to a large value. A scanned target or on-path attacker returning a crafted IPv6 response with a truncated extension header can trigger out-of-bounds reads and a crash during raw IPv6 scans.

References (4)

Core 4
Core References
Release Notes release-notes
Nmap Change Log
https://nmap.org/changelog.html
Third Party Advisory third-party-advisory
VulnCheck Advisory: Nmap - Integer Underflow in IPv6 Extension Header Parsing
https://www.vulncheck.com/advisories/nmap-integer-underflow-in-ipv6-extension-header-parsing

Scores

CVSS v3 6.5
EPSS 0.0028
EPSS Percentile 19.7%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L

CISA SSVC

Vulnrichment
Exploitation poc
Automatable yes
Technical Impact partial

Details

CWE
CWE-191
Status published
Products (2)
Nmap/Nmap < 7.99
nmap/nmap < 7.99
Published Jun 28, 2026
Tracked Since Jun 28, 2026