CVE-2026-58058

MediumCVSS 6.5

Published: 28/06/2026(UTC)Updated: 25/10/2026(UTC)Translated: 01/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Elevated risk

1.45%

73th percentile - higher than 73% of all known CVEs

Summary

A vulnerability in Nmap through version 7.99 causes the ipv6_get_data_primitive function to improperly handle IPv6 extension header boundaries, leading to out-of-bounds reads. An attacker can trigger a crash by sending a crafted IPv6 response with a truncated extension header during raw IPv6 scans.

Risk Assessment

The risk involves an on-path or targeted attacker being able to crash Nmap during IPv6 scanning, potentially disrupting security audits and causing denial of service.

Recommendation

Upgrade Nmap to version 8.0 or later which includes the fix. If upgrade is not possible, avoid using raw IPv6 scans (option -6) on untrusted networks.

Other vulnerabilities in Nmap

CVE-2026-72712Medium
Nmap up to and including version 7.99 contains a denial of service vulnerability that allows remote attackers to crash the application by sending a crafted packet with a zero-length TCP option. The malformed packet forces Packet:parse_options() in nselib/packet.lua to allocate objects in an infinite loop, causing an out-of-memory condition and application crash.

Original NVD description (English source)

Nmap through 7.99 does not keep the IPv6 extension-header walk within the captured packet in ipv6_get_data_primitive (libnetutil/netutil.cc), so the pointer advances past the buffer and the remaining-length computation underflows to a large value. A scanned target or on-path attacker returning a crafted IPv6 response with a truncated extension header can trigger out-of-bounds reads and a crash during raw IPv6 scans.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS