Unauthenticated Root RCE in GNU Inetutils `telnetd`

Researchers disclosed CVE-2026-32746, a critical telnetd vulnerability in GNU Inetutils that allows an unauthenticated remote attacker to achieve root remote code execution by exploiting a buffer overflow in the LINEMODE SLC (Set Local Characters) option handler. The flaw affects GNU Inetutils telnetd through version 2.7, carries a CVSS 9.8, and can be triggered during the initial Telnet handshake on port 23 before any login prompt appears, requiring no credentials, no user interaction, and no special network position.

The issue was discovered and reported by Dream on March 11, 2026, and GNU maintainers reportedly confirmed the finding, with a fix expected by April 1, 2026. Both reports warn that successful exploitation can lead to full system compromise because telnetd often runs with elevated privileges, enabling follow-on activity such as persistent backdoors, data theft, and lateral movement. The risk is especially acute in legacy environments where Telnet remains in use, including ICS/OT, PLC, SCADA, and some government systems, even though public reporting has not yet indicated active exploitation in the wild.