CVE-2026-58058Disclosure(nmap / nmap)

LOWCVSS 6.9 · MEDIUM

Signal is active with 1 mentions in latest observed window

Immediate actions

  • Track advisory updates for patch or workaround availability

Recommended action window: Monitor and triage in normal cycle

NVD description

Nmap through 7.99 does not keep the IPv6 extension-header walk within the captured packet in ipv6_get_data_primitive (libnetutil/netutil.cc), so the pointer advances past the buffer and the remaining-length computation underflows to a large value. A scanned target or on-path attacker returning a crafted IPv6 response with a truncated extension header can trigger out-of-bounds reads and a crash during raw IPv6 scans.

0.0/ 10 priority

Sources & remediation

Weakness type (CWE)
CWE-191

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

AVAILABLE

Momentum

STABLE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

  • nmap

Threat summary

  • 2 mentions across 2 observed days
  • Momentum state: stable

What's happening

  • Technical details provided in 1 signal
  • Disclosure: 1 classified signal
  • General: 1 classified signal
  • Peaked 1d ago at 1 mentions (2026-06-28); latest day: 1
  • 2 total mentions across 2 days

Affected systems

Vendors
Products
nmap

Deep dive

Activity timeline2 mentions / 2d
00111Mentions · 2026-06-28: 1Mentions · 2026-06-29: 1Technical Details · 2026-06-28: 106-2806-29
Signal classification2 categories
Disclosure
150.0%
General
150.0%
Referenced assets1 URL
By indicator
Classification over time
DateTotalLabels
2026-06-281
Disclosure1
2026-06-291
General1
Full discourse2 posts
  • Drets digitals@dretsdigitals
    General

    @OpenAI La investigació documentada en aquest repositori ha donat lloc a l'assignació de diversos identificadors internacionals de seguretat (CVE), com ara des del CVE-2026-58049 fins al CVE-2026-58058. Així que almenys en part el que troba és real i amb impacte.

    Post summary

    The tweet announces that a research repository has led to the assignment of several CVE IDs, but provides no further technical or exploitation details.

    1002049
    182 followersView on X
  • Vulmon Vulnerability Feed@VulmonFeeds
    Disclosure

    CVE-2026-58058 Out-of-Bounds Read in Nmap Through 7.99 IPv6 Extension Header Processing https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-58058

    Post summary

    The headline announces an out‑of‑bounds read flaw in Nmap 7.99 related to IPv6 extension header processing, but provides no proof‑of‑concept, exploit code, or patch information.

    00021154
    4.1K followersView on X
CPE platform detail1 entries

1 of 1 entries

PartVendorProductVersionTarget SWTarget HW
Appnmapnmap---

Explore more