Back to KEVs

CVE-2026-32746

telnetd in GNU inetutils through 2.7 allows an out-of-bounds write in the LINEMODE SLC (Set Local Characters) suboption handler because add_slc...

Basic Information

CVE State
PUBLISHED
Reserved Date
March 13, 2026
Published Date
March 13, 2026
Last Updated
March 23, 2026
Vendor
GNU
Product
inetutils
Description
telnetd in GNU inetutils through 2.7 allows an out-of-bounds write in the LINEMODE SLC (Set Local Characters) suboption handler because add_slc does not check whether the buffer is full.

CVSS Scores

CVSS v3.1

9.8 - CRITICAL

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

SSVC Information

Exploitation
poc
Automatable
Yes
Technical Impact
total

Exploit Status

Exploited in the Wild
Yes (2026-03-18 06:09:26 UTC) Source

References

https://www.openwall.com/lists/oss-security/2026/03/12/4 https://lists.gnu.org/archive/html/bug-inetutils/2026-03/msg00031.html

Known Exploited Vulnerability Information

Source Added Date
The Shadowserver (via CIRCL) 2026-03-18 06:09:26 UTC

Timeline

  • CVE ID Reserved

  • CVE Published to Public

  • Added to KEVIntel