Nmap through 7.99 does not keep the IPv6 extension-header walk within the captured packet in ipv6_get_data_primitive (libnetutil/netutil.cc), so the pointer advances past the buffer and the remaining-length computation underflows to a large value. A scanned target or on-path attacker returning a crafted IPv6 response with a truncated extension header can trigger out-of-bounds reads and a crash during raw IPv6 scans.
Fix
Public exploits 1
- Nmap 7.99 - Extension Header Integer Underflow (dos · multiple) Exploit-DB · 2026-08-17
Each line links to the index that lists it, never to exploit code. Exploit-DB's "verified" and a Metasploit rank of good or better count as verified; a PoC-in-GitHub entry is a repository's claim.
Patch, vendor advisory and mitigation references on NVD 3
- https://github.com/nmap/nmap/commit/bb6754e76bb1686315008e1aa1c40202a513fb83 Patch
- https://nmap.org/changelog.html Patch, Release Notes
- https://www.vulncheck.com/advisories/nmap-integer-underflow-in-ipv6-extension-header-parsing Patch, Third Party Advisory
Every line above is quoted from NVD, CISA, Microsoft, the vendor's own advisory or DISA; nothing is generated.
Change history 1
- First seenCVSS 6.9 · nmapNVD modified 2026-10-25 17:10
Affected (CPE criteria) 1
cpe:2.3:a:nmap:nmap:*:*:*:*:*:*:*:*
References 4
- https://github.com/bikini/exploitarium/tree/main/nmap-ipv6-extlen-wrap-poc Broken Link
- https://github.com/nmap/nmap/commit/bb6754e76bb1686315008e1aa1c40202a513fb83 Patch
- https://nmap.org/changelog.html Patch, Release Notes
- https://www.vulncheck.com/advisories/nmap-integer-underflow-in-ipv6-extension-header-parsing Patch, Third Party Advisory