CVE-2026-58058: 
Nmap vulnerability analysis and mitigation

CVE-2026-58058 is an integer underflow and out-of-bounds read vulnerability in Nmap's IPv6 extension header parser, affecting all versions through 7.99. The flaw exists in the ipv6_get_data_primitive function in libnetutil/netutil.cc, where the pointer can advance past the captured packet buffer, causing the remaining-length computation to underflow to a very large unsigned integer value. A scanned target or on-path attacker returning a crafted IPv6 response with a truncated extension header can trigger out-of-bounds reads and a crash during raw IPv6 scans. Disclosed on June 28, 2026, it carries a CVSS v3.1 base score of 6.5 (Medium) and a CVSS v4.0 base score of 6.9 (Medium) (Github Advisory, VulnCheck).

The root cause is classified as CWE-191 (Integer Underflow/Wraparound) and CWE-125 (Out-of-bounds Read). In ipv6_get_data_primitive (libnetutil/netutil.cc, lines 688–712), the extension header walk advances the pointer p by (*(p+1) + 1) * 8 bytes without verifying that the new pointer position remains within the captured packet buffer. If a crafted extension header declares a length that moves p beyond the packet end, the subsequent computation end - p wraps around when stored in an unsigned integer, yielding a very large value (e.g., 4294967288). Downstream consumers in scan_engine_raw.cc and tcpip.cc then treat the packet as if it contains a valid upper-layer payload at an out-of-bounds offset, enabling out-of-bounds reads and potential crashes. A public PoC (poc/ipv6_extlen_wrap_probe.cpp) demonstrating the parser behavior is available in the bikini/exploitarium repository (PoC Repository, Nmap Commit).

Successful exploitation allows an unauthenticated network attacker — either a scanned target or an on-path adversary — to crash the Nmap scanning process (denial of service) and potentially leak small amounts of memory from the scanning host's process space. The confidentiality impact is limited to minor memory disclosure from the Nmap process itself, with no integrity impact and no lateral movement potential beyond disrupting the scanning operation. The vulnerability affects any system running Nmap in raw IPv6 scan mode (e.g., -6 flag with SYN, ACK, or other raw scan types) (Github Advisory, VulnCheck).

1. Identify target: Determine that the victim host is running Nmap version ≤ 7.99 and is performing raw IPv6 scans (e.g., using nmap -6 -sS or similar raw scan types against a network that includes attacker-controlled hosts).
2. Position as scanned target or on-path attacker: The attacker must either control an IPv6 host being scanned by the victim's Nmap instance, or be positioned on-path to intercept and respond to Nmap's raw IPv6 probe packets.
3. Craft malicious IPv6 packet: Construct a malformed IPv6 packet with the following characteristics:
   • Total captured length: 48 bytes
   • IPv6 payload length field: 8
   • Next header: Hop-by-Hop Options (0x00)
   • Extension header next header: UDP (17)
   • Extension header length field: 1 (causing p to advance by (1+1)*8 = 16 bytes beyond the 8-byte payload, i.e., to offset 56 in a 48-byte packet)
4. Send crafted response: Return this packet to the scanning Nmap process in response to its IPv6 probe. The ipv6_get_data_primitive function will advance p past the buffer end without a bounds check.
5. Trigger integer underflow: The remaining-length computation end - p wraps to a large unsigned value (e.g., 4294967288), causing downstream consumers in scan_engine_raw.cc to perform out-of-bounds reads.
6. Achieve DoS/memory disclosure: Nmap crashes or reads out-of-bounds memory, resulting in denial of service of the scanning process and potential minor memory leakage (PoC Repository, Nmap Commit).

• Process: Unexpected crash or termination of the nmap process during raw IPv6 scans; core dump files generated by the Nmap process (e.g., core, core.nmap.<pid>) in the working directory.
• Logs: System logs (e.g., /var/log/syslog, /var/log/messages) showing segmentation fault or abort signals from the nmap process; application-level error output referencing IPv6 packet parsing failures.
• Network: Inbound IPv6 packets with malformed extension headers (Next Header = Hop-by-Hop Options, declared extension length causing pointer to exceed captured packet length) arriving in response to Nmap probe packets; packets where the IPv6 payload length field is inconsistent with the actual captured frame size.
• File System: Unexpected core dump files in the directory from which Nmap was executed, timestamped during active IPv6 scan sessions (PoC Repository).

The Nmap project has patched the vulnerability in commit bb6754e, which adds a post-advance containment check (if (p >= end) return NULL;) and strengthens the pre-advance check from p + 2 > end to p + 8 > end in libnetutil/netutil.cc. Users should update Nmap to any version released after 7.99 that includes this fix; Fedora packages have already been updated. As a workaround, restrict IPv6 scanning to trusted networks where crafted responses are unlikely, or avoid raw IPv6 scan modes (-sS, -sA, etc.) against untrusted targets until patched (Nmap Commit, Nmap Changelog, Red Hat Bugzilla).

Red Hat opened a Bugzilla tracking entry (Bug 2493951) classifying the issue as medium severity for RHEL and assigned it to the Product Security DevOps Team. Fedora issued package updates for Fedora 44 and other releases to address the vulnerability. InfoSecurity Magazine covered the disclosure in the context of the exploitarium repository's public PoC release. The vulnerability was assigned by VulnCheck and received coverage from Linux security news outlets including LinuxSecurity.com and Pro-Linux.de (Red Hat Bugzilla, InfoSecurity Magazine).