CVE-2026-58058

What it actually does

Nmap through 7.99 contains an IPv6 packet parsing flaw in ipv6_get_data_primitive in libnetutil/netutil.cc. During raw IPv6 scans, Nmap walks IPv6 extension headers without ensuring the next header remains inside the captured packet buffer. A malformed or truncated IPv6 extension header can cause the parser pointer to advance past the end of the packet and make the remaining-length calculation underflow to a very large value. The practical result is out-of-bounds memory reads and likely process termination. The impact is primarily availability of the scanning process and reliability of scan results; the disclosed behavior does not indicate code execution or data modification.

Why it matters to the business

Organizations that rely on Nmap for asset discovery, exposure management, vulnerability validation, or incident response may see scans fail or terminate when probing malicious, compromised, or misconfigured IPv6 targets. This can create blind spots in security inventories and delay detection of exposed services. The CVSS score is moderate and EPSS is currently low, with no known KEV listing or ransomware association, but exploitation is network-reachable and requires no authentication or user interaction, so Internet-facing or untrusted IPv6 scanning workflows should still be treated as operationally relevant.

How an attack unfolds

An attacker must be in a position to send IPv6 responses to a host running vulnerable Nmap scans. This can be the scanned target itself or an on-path actor capable of spoofing or modifying traffic. The operator runs a raw IPv6 scan against the attacker-controlled or intercepted address. The attacker returns an IPv6 packet containing an extension-header chain where an extension header is truncated or otherwise crafted so Nmap advances its parsing pointer beyond the captured packet boundary. Because the remaining packet length is then computed from an invalid pointer position, the length underflows and Nmap attempts to read outside the valid buffer. In typical exploitation, the Nmap process crashes, interrupting the scan and potentially causing incomplete or misleading discovery results.

How to fix it

Upgrade Nmap to a version newer than 7.99 once a fixed release is available from the Nmap project or from the operating system/package vendor. Because exact fixed versions were not provided, track vendor advisories and distribution security updates for the package named nmap. Until patched packages are available, reduce exposure by avoiding raw IPv6 scans against untrusted networks where feasible, running Nmap scans inside supervised jobs that automatically retry and record failures, segmenting scanning infrastructure from critical production workflows, and treating scan crashes against specific IPv6 targets as suspicious. Where operationally acceptable, disable IPv6 scan modes or use scan types that do not exercise raw IPv6 packet parsing for untrusted targets.

How to confirm the fix worked

Confirm the installed Nmap version is not vulnerable by running nmap --version and verifying it is newer than 7.99 or matches a vendor-patched build. On Linux distributions, also verify package metadata with the native package manager, such as apt list --installed nmap, dpkg -l nmap, rpm -q nmap, dnf info nmap, or yum info nmap. Review vendor changelogs for a fix referencing IPv6 extension-header parsing, ipv6_get_data_primitive, libnetutil/netutil.cc, out-of-bounds reads, or this vulnerability. Validate operationally by running representative IPv6 scanning jobs in a controlled environment and confirming Nmap no longer crashes when receiving malformed or truncated IPv6 extension-header packets. For temporary mitigations, confirm scheduled scans have IPv6/raw scan options disabled where intended and that scan job monitoring alerts on abnormal Nmap termination.

Typical attack path

1. Attacker controls an IPv6 host being scanned or has an on-path position between the scanner and target.
2. A vulnerable Nmap version through 7.99 performs a raw IPv6 scan that causes Nmap to parse IPv6 extension headers from received traffic.
3. The attacker sends a crafted IPv6 response with a truncated or malformed extension header chain.
4. Nmap's IPv6 parser advances beyond the captured packet buffer and computes an invalid remaining length.
5. Nmap performs an out-of-bounds read and crashes or terminates abnormally.
6. The scan fails or produces incomplete results, creating an availability issue for scanning and monitoring workflows.

How to detect it

Look for evidence that Nmap crashed or terminated abnormally during raw IPv6 scans. Relevant sources include scan scheduler logs, vulnerability management platform job logs, EDR process telemetry, Linux syslog or journald, crash reporters such as systemd-coredump, ABRT, Apport, macOS crash logs, and packet captures from scanner interfaces. Search for segmentation faults, bus errors, aborts, core dumps, or exit codes associated with the nmap process, particularly when the scan target was IPv6 or when failures repeatedly occur for the same IPv6 address or route. Network evidence may include inbound IPv6 packets to the scanner with extension headers where the captured packet ends before the declared extension-header length. If packet capture is available, review traffic immediately before the crash for malformed Hop-by-Hop Options, Destination Options, Routing, Fragment, Authentication Header, or other IPv6 extension-header chains. There are no named threat actors or known exploited-in-the-wild status supplied, so prioritize anomaly-based detection around crashes and malformed IPv6 responses rather than actor-specific indicators.

• nmap: segfault
• nmap segfault
• segfault at
• comm="nmap"
• process_name=nmap
• systemd-coredump
• Process nmap dumped core
• nmap.core
• core.nmap
• /var/lib/systemd/coredump/
• /var/crash/
• /var/crash/_usr_bin_nmap
• /usr/bin/nmap
• /usr/local/bin/nmap
• libnetutil/netutil.cc
• ipv6_get_data_primitive
• IPv6 extension header
• truncated extension header
• raw IPv6 scan

What your security team should do

• Inventory all systems, containers, scanner appliances, CI jobs, and security tools that bundle or invoke Nmap, especially those performing IPv6 scanning.
• Prioritize upgrades for scanning infrastructure that probes untrusted, Internet-facing, third-party, or adversary-controlled IPv6 address space.
• Monitor vendor and distribution advisories for the first fixed Nmap release or backported package, since no exact fixed version was provided in the input.
• Until patched, disable or limit raw IPv6 scans against untrusted networks where business impact is acceptable.
• Add monitoring for abnormal Nmap exits, core dumps, segmentation faults, or repeated scan failures tied to specific IPv6 targets.
• Treat repeatable crashes against the same IPv6 address or route as potentially adversarial and preserve packets, logs, and core dumps for analysis.
• Run Nmap under process supervision with timeouts, retry logic, and logging so failed scans do not silently create asset inventory gaps.