CVE-2026-58058: Nmap IPv6 Extension Header Buffer Underflow and Out-of-Bounds Read

Technical summary

The vulnerability exists in libnetutil/netutil.cc within the ipv6_get_data_primitive function. IPv6 packets can contain extension headers that chain together; Nmap walks these headers to extract payload data. The code fails to enforce that pointer advancement stays within the captured packet bounds. When a response includes a truncated extension header, the pointer exceeds the buffer end, and the remaining-length field—computed as an unsigned integer—wraps to a large value due to integer underflow (CWE-191). Subsequent read operations then access memory far beyond the intended range, causing either information disclosure or a denial-of-service crash. The flaw is reachable from the network without authentication or privileges.

Business impact

Organizations relying on Nmap for vulnerability assessment, security scanning, or network reconnaissance face service interruptions when scanning IPv6-enabled targets. An attacker or compromised network path could exploit this to crash Nmap scans, disrupting security operations and delaying incident response or compliance activities. The memory read aspect may leak sensitive data from the scanning process, though impact depends on what data resides adjacent in memory. For blue teams and penetration testers, this could be weaponized defensively by a malicious target to disrupt reconnaissance efforts.

Affected systems

Nmap through version 7.99 is affected. This includes all stable and development releases up to and including 7.99. The flaw is triggered only during IPv6 raw-packet scans, so systems using Nmap exclusively for IPv4 scanning or using higher-level scanning modes that don't rely on raw IPv6 processing face lower risk. Environments actively scanning IPv6 networks or hybrid IPv4/IPv6 infrastructure are most exposed.

Exploitability

Exploitability is straightforward from a network perspective: no authentication, special privileges, or user interaction is required. Any IPv6-capable target or on-path network actor can craft and return a malicious IPv6 response. The attack surface is active—it triggers during the scan itself, not as a separate step. However, the attacker must either control a scanned target or be positioned in-path to inject packets. The required network access and low complexity of packet construction lead to a CVSS score of 6.5 (Medium), reflecting local information disclosure and denial-of-service impact without full system compromise.

Remediation

Upgrade Nmap to a version newer than 7.99 that includes the corrected ipv6_get_data_primitive function. Verify patched versions against official Nmap release notes and security advisories. For organizations unable to patch immediately, restrict raw IPv6 scanning in untrusted network environments, or disable IPv6 scanning if not operationally required. Use network segmentation to reduce exposure to untrusted targets. Monitor Nmap process behavior for crashes and enable logging to detect exploitation attempts.

Patch guidance

Check the official Nmap project website and release notes for versions after 7.99 that address CVE-2026-58058. Apply patches to all systems running Nmap in your security infrastructure, including vulnerability scanners, penetration testing platforms, and security operations workstations. Test patched versions in a non-production environment against your typical IPv6 scanning targets to ensure compatibility. Coordinate patching with security operations to minimize disruption to active scanning schedules.

Detection guidance

Monitor system logs and Nmap process exit codes for unexpected crashes or segmentation faults during IPv6 scans. Implement network-level detection for malformed IPv6 packets with truncated extension headers sent to your scanning infrastructure—such packets are abnormal and may indicate attack attempts. Correlate Nmap crashes with inbound IPv6 traffic from specific targets. Set up alerting for any scanner restarts or failures that coincide with IPv6 reconnaissance activity. In forensic investigations, examine packet captures from failed scans to identify malformed IPv6 responses.

Why prioritize this

Although rated CVSS 6.5 (Medium), this vulnerability warrants prompt attention because Nmap is critical infrastructure for security teams. Any interruption to scanning operations delays threat detection and compliance verification. The network-reachable nature and low attack complexity mean opportunistic exploitation by any responsive target is possible. Organizations with active IPv6 scanning programs should prioritize patching. Those with limited IPv6 infrastructure can defer slightly but should still update within their standard patch cycle.

Risk score, explained

The CVSS 3.1 score of 6.5 reflects: (1) Network-based attack vector with no authentication required, lowering the bar for exploitation; (2) Low attack complexity—crafting a truncated IPv6 extension header is straightforward; (3) Partial confidentiality impact via out-of-bounds reads potentially exposing memory contents; (4) Availability impact through denial of service (scanner crash). The score excludes integrity impact because the flaw does not allow arbitrary writes or command execution. While not critical, the combination of easy exploitation and direct impact on security operations elevates risk for organizations dependent on Nmap.

Frequently asked questions