6.5 CVE-2026-58058

Enriched by CISA Patch
 

Nmap through 7.99 does not keep the IPv6 extension-header walk within the captured packet in ipv6_get_data_primitive (libnetutil/netutil.cc), so the pointer advances past the buffer and the remaining-length computation underflows to a large value. A scanned target or on-path attacker returning a crafted IPv6 response with a truncated extension header can trigger out-of-bounds reads and a crash during raw IPv6 scans.
https://nvd.nist.gov/vuln/detail/CVE-2026-58058

Categories

CWE-191 : Integer Underflow (Wrap or Wraparound)
This can happen in signed and unsigned cases.

References


 

AFFECTED (from MITRE)

Vendor Product Versions
Nmap Nmap
  • ≤ 7.99 [affected]
© 2022 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation.

CPE

cpe start end
Configuration 1
cpe:2.3:a:nmap:nmap:*:*:*:*:*:*:*:* <= 7.99

REMEDIATION

Patch

Url
https://github.com/nmap/nmap/commit/bb6754e76bb1686315008e1aa1c40202a513fb83
https://nmap.org/changelog.html
https://www.vulncheck.com/advisories/nmap-integer-underflow-in-ipv6-extension...

EXPLOITS

Exploit-db.com

id description date
No known exploits

POC Github

Url
No known exploits

Other Nist (github, ...)

Url
No known exploits

CAPEC

Common Attack Pattern Enumerations and Classifications

id description severity
No entry