CVE-2026-32746
MediumSummary
telnetd in GNU inetutils through 2.7 allows an out-of-bounds write in the LINEMODE SLC (Set Local Characters) suboption handler because add_slc does not check whether the buffer is full.
Risk Assessment
This vulnerability may lead to unauthorized access or system crashes, posing a threat to the integrity and availability of services.
Recommendation
It is recommended to update GNU inetutils to the latest version to mitigate this vulnerability and to monitor systems for unauthorized access.
Other vulnerabilities in GNU inetutils
See all- CVE-2026-32772Medium
A vulnerability in telnet in GNU inetutils through version 2.7 allows servers to read arbitrary environment variables from clients via the NEW_ENVIRON SEND USERVAR command.
- CVE-2023-40303High
GNU inetutils before 2.5 may allow privilege escalation due to unchecked return values of set*id() family functions in ftpd, rcp, rlogin, rsh, rshd, and uucpd.
Original NVD description (English source)
telnetd in GNU inetutils through 2.7 allows an out-of-bounds write in the LINEMODE SLC (Set Local Characters) suboption handler because add_slc does not check whether the buffer is full.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS