Executive brief
Nmap, a widely used network scanning and security auditing tool, is vulnerable to a flaw in how it processes certain network traffic. A malicious target being scanned or an attacker on the same network can send specially crafted IPv6 packets that cause Nmap to crash or read unintended memory. This could disrupt security scanning operations and potentially expose small amounts of internal program data.
Technical details
An integer underflow vulnerability exists in Nmap's 'ipv6_get_data_primitive' function within 'libnetutil/netutil.cc'. The parser fails to validate that the IPv6 extension-header walk remains within the bounds of the captured packet buffer. When processing a truncated extension header, the payload pointer can advance beyond the buffer end, causing the remaining-length calculation to underflow to a large unsigned value. A remote attacker (scanned target or on-path) can exploit this by returning a crafted IPv6 response, leading to out-of-bounds reads and an application crash during raw IPv6 scans. A fix has been committed to the Nmap development tree.
Affected products
- Nmap Nmap through 7.99
Timeline
- 2026-03-26: patched: Nmap 7.99 released (though advisory suggests vulnerability persists through 7.99, fix commit followed)
- 2026-06-27: advisory: VulnCheck advisory published
- 2026-06-28: disclosed: CVE published to NVD