CVE-2026-32746

GNU inetutils telnetd contains an out-of-bounds write (CWE-120) in the LINEMODE SLC (Set Local Characters) suboption handler, where the add_slc function writes into a fixed-size buffer without first checking whether it is full. A remote, unauthenticated attacker can trigger it by connecting to the telnet daemon and sending a crafted LINEMODE SLC suboption that overflows the buffer, with no user interaction or privileges required. Successful exploitation of the memory corruption can yield remote code execution with the privileges of telnetd or crash the daemon, consistent with the CVSS 9.8 critical score. All GNU inetutils versions through 2.7 are affected wherever telnetd is enabled. As of the latest reporting the flaw is unpatched, a public PoC/technical analysis exists, it is not yet listed in CISA KEV, and EPSS assigns a 23.7% chance of exploitation within 30 days (98th percentile), so no confirmed in-the-wild exploitation is known.

What to do: Inventory systems for the inetutils telnetd package and disable the daemon or restrict TCP port 23 to trusted networks, preferring SSH where possible. No fixed version is available yet, so monitor GNU inetutils announcements and the referenced bug-report thread and upgrade promptly once a patched release ships. In the interim, use firewall/ACL rules to prevent untrusted hosts from reaching telnetd.