Every CVE Search/ Get API key

CVE-2026-32746

telnetd in GNU inetutils through 2.7 allows an out-of-bounds write in the LINEMODE SLC (Set Local...

9.8 CriticalPublic exploitFix available

telnetd in GNU inetutils through 2.7 allows an out-of-bounds write in the LINEMODE SLC (Set Local Characters) suboption handler because add_slc does not check whether the buffer is full.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
High
Integrity
High
Availability
High

Exploit likelihood

44.8%Up 44.8 points since Mar 14, 2026
90%50%10%1%

What each source reports

CVE List Score used 9.8

telnetd in GNU inetutils through 2.7 allows an out-of-bounds write in the LINEMODE SLC (Set Local Characters) suboption handler because add_slc does not check whether the buffer is full.

Record
CVE-2026-32746
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness
CWE-120
Updated
2026-11-02
EUVDEUVD-2026-12065 9.8

telnetd in GNU inetutils through 2.7 allows an out-of-bounds write in the LINEMODE SLC (Set Local Characters) suboption handler because add_slc does not check whether the buffer is full.

Record
EUVD-2026-12065
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
GitHub AdvisoriesGHSA-qvfm-56cp-4988 9.8

telnetd in GNU inetutils through 2.7 allows an out-of-bounds write in the LINEMODE SLC (Set Local...

telnetd in GNU inetutils through 2.7 allows an out-of-bounds write in the LINEMODE SLC (Set Local Characters) suboption handler because add_slc does not check whether the buffer is full.

Record
GHSA-qvfm-56cp-4988
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness
CWE-120
Updated
2026-11-02
NVD 9.8

telnetd in GNU inetutils through 2.7 allows an out-of-bounds write in the LINEMODE SLC (Set Local Characters) suboption handler because add_slc does not check whether the buffer is full.

Record
CVE-2026-32746
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness
CWE-120
Updated
2026-11-02
OSVALPINE-CVE-2026-32746 9.8

telnetd in GNU inetutils through 2.7 allows an out-of-bounds write in the LINEMODE SLC (Set Local Characters) suboption handler because add_slc does not check whether the buffer is full.

Record
ALPINE-CVE-2026-32746
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-03
OSVDEBIAN-CVE-2026-32746 9.8

telnetd in GNU inetutils through 2.7 allows an out-of-bounds write in the LINEMODE SLC (Set Local Characters) suboption handler because add_slc does not check whether the buffer is full.

Record
DEBIAN-CVE-2026-32746
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
Show 6 moreShow less
OSVUBUNTU-CVE-2026-32746 9.8

telnetd in GNU inetutils through 2.7 allows an out-of-bounds write in the LINEMODE SLC (Set Local Characters) suboption handler because add_slc does not check whether the buffer is full.

Record
UBUNTU-CVE-2026-32746
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVMGASA-2026-0122 No score

Updated krb5-appl packages fix security vulnerability

telnetd in GNU inetutils through 2.7 allows an out-of-bounds write in the LINEMODE SLC (Set Local Characters) suboption handler because add_slc does not check whether the buffer is full. (CVE-2026-32746)

Record
MGASA-2026-0122
Updated
2026-11-02
OSVopenSUSE-SU-2026:10657-1 No score

krb5-appl-clients-1.0.3-6.1 on GA media

These are all security issues fixed in the krb5-appl-clients-1.0.3-6.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2026:10657-1
Updated
2026-11-02
OSVopenSUSE-SU-2026:20374-1 No score

Security update for krb5-appl

This update for krb5-appl fixes the following issues:

Changes in krb5-appl:

  • CVE-2026-32746: Remote Pre-Auth Buffer Overflow in GNU Inetutils telnetd LINEMODE (bsc#1259691)
Record
openSUSE-SU-2026:20374-1
Updated
2026-11-02
OSVSUSE-SU-2026:0930-1 No score

Security update for krb5-appl

This update for krb5-appl fixes the following issue:

  • CVE-2026-32746: Remote Pre-Auth Buffer Overflow in GNU Inetutils telnetd LINEMODE (bsc#1259691).
Record
SUSE-SU-2026:0930-1
Updated
2026-11-02
OSVUSN-8387-1 No score

inetutils vulnerabilities

It was discovered that the Inetutils telnet daemon incorrectly handled the CREDENTIALS_DIRECTORY environment variable. An attacker could possibly use this issue to escalate privileges. (CVE-2026-28372)

It was discovered that the Inetutils telnet daemon did not properly validate buffer bounds when processing LINEMODE SLC suboptions. An attacker could possibly use this issue to cause a denial of service or execute arbitrary code. (CVE-2026-32746)

It was discovered that the Inetutils telnet client incorrectly handled the NEW_ENVIRON SEND USERVAR option. An attacker could possibly use this issue to read arbitrary environment variables. (CVE-2026-32772)

Record
USN-8387-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
inetutils-telnet
Alpine:v3.24
 before 2.8-r0
2.8-r0
inetutils
Debian:12
 before 2:2.4-2+deb12u3, plus listed versions
2:2.4-22:2.4-2+deb12u12:2.4-2+deb12u2
2:2.4-2+deb12u3
inetutils
Debian:13
 before 2:2.6-3+deb13u3, plus listed versions
2:2.6-32:2.6-3+deb13u12:2.6-3+deb13u2
2:2.6-3+deb13u3
inetutils
Debian:14
 before 2:2.7-4, plus listed versions
2:2.6-32:2.6-42:2.7-12:2.7-22:2.7-3
2:2.7-4
krb5-appl
Mageia:9
 before 1.0.3-16.1.mga9
1.0.3-16.1.mga9
krb5-appl
SUSE:Linux Enterprise Server 12 SP5-LTSS
 before 1.0.3-3.12.1
1.0.3-3.12.1
krb5-appl
SUSE:Linux Enterprise Server LTSS Extended Security 12 SP5
 before 1.0.3-3.12.1
1.0.3-3.12.1
inetutils
Ubuntu:Pro:14.04:LTS
 before 2:1.9.2-1ubuntu0.1~esm4, plus listed versions
2:1.9.1.306-0a482-12:1.9.1.363-bbc1-12:1.9.2-12:1.9.2-1ubuntu0.1~esm12:1.9.2-1ubuntu0.1~esm2
2:1.9.2-1ubuntu0.1~esm4
inetutils
Ubuntu:Pro:16.04:LTS
 before 2:1.9.4-1ubuntu0.1~esm6, plus listed versions
2:1.9.4-12:1.9.4-1build12:1.9.4-1ubuntu0.1~esm12:1.9.4-1ubuntu0.1~esm22:1.9.4-1ubuntu0.1~esm32:1.9.4-1ubuntu0.1~esm5
2:1.9.4-1ubuntu0.1~esm6
inetutils
Ubuntu:Pro:18.04:LTS
 before 2:1.9.4-3ubuntu0.1+esm5, plus listed versions
2:1.9.4-2build12:1.9.4-32:1.9.4-3ubuntu0.12:1.9.4-3ubuntu0.1+esm12:1.9.4-3ubuntu0.1+esm22:1.9.4-3ubuntu0.1+esm4
2:1.9.4-3ubuntu0.1+esm5
Show 15 moreShow less
Affected packages
PackageAffectedFixed
inetutils
Ubuntu:Pro:20.04:LTS
 before 2:1.9.4-11ubuntu0.2+esm4, plus listed versions
2:1.9.4-10build12:1.9.4-112:1.9.4-11ubuntu0.12:1.9.4-11ubuntu0.1+esm12:1.9.4-11ubuntu0.22:1.9.4-11ubuntu0.2+esm12:1.9.4-11ubuntu0.2+esm3
2:1.9.4-11ubuntu0.2+esm4
inetutils
Ubuntu:Pro:22.04:LTS
 before 2:2.2-2ubuntu0.2+esm1, plus listed versions
2:2.0-12:2.2-22:2.2-2ubuntu0.12:2.2-2ubuntu0.2
2:2.2-2ubuntu0.2+esm1
inetutils
Ubuntu:24.04:LTS
 before 2:2.5-3ubuntu4.2, plus listed versions
2:2.4-2ubuntu22:2.4-3ubuntu12:2.5-3ubuntu12:2.5-3ubuntu32:2.5-3ubuntu42:2.5-3ubuntu4.1
2:2.5-3ubuntu4.2
inetutils
Ubuntu:25.10
 before 2:2.6-1ubuntu3.2, plus listed versions
2:2.5-6ubuntu12:2.6-1ubuntu12:2.6-1ubuntu32:2.6-1ubuntu3.1
2:2.6-1ubuntu3.2
inetutils
Ubuntu:26.04:LTS
 before 2:2.7-2ubuntu1.1, plus listed versions
2:2.6-1ubuntu32:2.6-4ubuntu12:2.7-2ubuntu1
2:2.7-2ubuntu1.1
inetutils
Ubuntu:Pro:14.04:LTS
From an advisory covering 3 CVEs
 before 2:1.9.2-1ubuntu0.1~esm4, plus listed versions
2:1.9.1.306-0a482-12:1.9.1.363-bbc1-12:1.9.2-12:1.9.2-1ubuntu0.1~esm12:1.9.2-1ubuntu0.1~esm2
2:1.9.2-1ubuntu0.1~esm4
inetutils
Ubuntu:Pro:16.04:LTS
From an advisory covering 3 CVEs
 before 2:1.9.4-1ubuntu0.1~esm6, plus listed versions
2:1.9.4-12:1.9.4-1build12:1.9.4-1ubuntu0.1~esm12:1.9.4-1ubuntu0.1~esm22:1.9.4-1ubuntu0.1~esm32:1.9.4-1ubuntu0.1~esm5
2:1.9.4-1ubuntu0.1~esm6
inetutils
Ubuntu:Pro:18.04:LTS
From an advisory covering 3 CVEs
 before 2:1.9.4-3ubuntu0.1+esm5, plus listed versions
2:1.9.4-2build12:1.9.4-32:1.9.4-3ubuntu0.12:1.9.4-3ubuntu0.1+esm12:1.9.4-3ubuntu0.1+esm22:1.9.4-3ubuntu0.1+esm4
2:1.9.4-3ubuntu0.1+esm5
inetutils
Ubuntu:Pro:20.04:LTS
From an advisory covering 3 CVEs
 before 2:1.9.4-11ubuntu0.2+esm4, plus listed versions
2:1.9.4-10build12:1.9.4-112:1.9.4-11ubuntu0.12:1.9.4-11ubuntu0.1+esm12:1.9.4-11ubuntu0.22:1.9.4-11ubuntu0.2+esm12:1.9.4-11ubuntu0.2+esm3
2:1.9.4-11ubuntu0.2+esm4
inetutils
Ubuntu:Pro:22.04:LTS
From an advisory covering 3 CVEs
 before 2:2.2-2ubuntu0.2+esm1, plus listed versions
2:2.0-12:2.2-22:2.2-2ubuntu0.12:2.2-2ubuntu0.2
2:2.2-2ubuntu0.2+esm1
inetutils
Ubuntu:24.04:LTS
From an advisory covering 3 CVEs
 before 2:2.5-3ubuntu4.2, plus listed versions
2:2.4-2ubuntu22:2.4-3ubuntu12:2.5-3ubuntu12:2.5-3ubuntu32:2.5-3ubuntu42:2.5-3ubuntu4.1
2:2.5-3ubuntu4.2
inetutils
Ubuntu:25.10
From an advisory covering 3 CVEs
 before 2:2.6-1ubuntu3.2, plus listed versions
2:2.5-6ubuntu12:2.6-1ubuntu12:2.6-1ubuntu32:2.6-1ubuntu3.1
2:2.6-1ubuntu3.2
inetutils
Ubuntu:26.04:LTS
From an advisory covering 3 CVEs
 before 2:2.7-2ubuntu1.1, plus listed versions
2:2.6-1ubuntu32:2.6-4ubuntu12:2.7-2ubuntu1
2:2.7-2ubuntu1.1
krb5-appl
openSUSE:Tumbleweed
 before 1.0.3-6.1
1.0.3-6.1
krb5-appl
openSUSE:Leap 16.0
 before 1.0.3-bp160.2.1
1.0.3-bp160.2.1

Public exploits

Links only. Every CVE stores no exploit code.

Public exploits
SourceLinkDate
PoC in GitHubjeffaf/cve-2026-327462026-03-18
PoC in GitHubduduLiu8787/CVE-2026-32746-Exploit2026-03-19
PoC in GitHubwatchtowrlabs/watchtowr-vs-telnetd-CVE-2026-327462026-03-19
PoC in GitHubchosenonehacks/CVE-2026-327462026-03-20
PoC in GitHubdanindiana/cve-2026-32746-mitigation2026-03-20
Exploit-DBtelnetd 2.7 - Buffer Overflow2026-05-07
PoC in GitHubkaleth4/CVE-2026-327462026-05-09
PoC in GitHubMonkeySeC-sys/Kangaroo2026-08-02

History

History
RecordedChangedSources
affected, facts
affected, aliases, exploits, referencesOSV
first indexedCVE List, EUVD, Exploit-DB, GitHub Advisories, NVD, OSV, PoC in GitHub

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-32746 is a critical vulnerability (CVSS 9.8) in Gnu Inetutils, published March 13, 2026. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 44.8%, the 98th percentile. Fixed in inetutils-telnet 2.8-r0.

References

Show 14 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open