CVE-2026-58058

Medium

Description

Nmap through 7.99 does not keep the IPv6 extension-header walk within the captured packet in ipv6_get_data_primitive (libnetutil/netutil.cc), so the pointer advances past the buffer and the remaining-length computation underflows to a large value. A scanned target or on-path attacker returning a crafted IPv6 response with a truncated extension header can trigger out-of-bounds reads and a crash during raw IPv6 scans.

SeverityMedium

CVSS6.5

Exploit probability—

ProductNmap

PublishedJun 28, 2026

First seenJun 28, 2026

Weakness typeCWE-191CWE-191

How to fix

Patches

github.com/nmap/nmap/commit/bb6754e76bb1686315008e1aa1c40202a513fb83

Vendor advisories

nmap.org/changelog.html

Affected products

Product	Affected versions	Fixed in
nmap nmap	v ≤ 7.99	—

Check your version

Choose the product and enter the version you run to see whether it falls in the affected range.

In the Intelligence 360 plan

Attack Surface Management

See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.