Nmap CVE-2026-58058

Nmap's raw packet engine uses ipv6_get_data_primitive in libnetutil/netutil.cc to walk IPv6 extension headers (as defined in RFC 8200) in order to locate the upper-layer protocol payload during raw IPv6 scans. Each IPv6 extension header has a minimum size of 8 bytes: one Next Header byte, one Header Extension Length (HEL) byte, and at least 6 bytes of data. The original code checked only that 2 bytes remained before reading the HEL byte and computing the next header offset as (hdrlen + 1) * 8 - without verifying the full declared length actually fit within the captured packet boundary. This allowed the walk pointer p to advance beyond end. The subsequent remaining = end - p computation, operating on unsigned integer types, then underflowed to a very large positive value (CWE-191: Integer Underflow/Wraparound), rendering all downstream buffer bounds checks ineffective and permitting arbitrary out-of-bounds reads and a crash. The upstream fix (commit bb6754e76bb1686315008e1aa1c40202a513fb83) corrects the initial check from p + 2 > end to p + 8 > end and adds an explicit if (p >= end) return NULL guard. Affected CPE: cpe:2.3:a:nmap:nmap:*:*:*:*:*:*:*:* (all versions through 7.99).