Critical Pre-Auth RCE in GNU InetUtils telnetd LINEMODE Handler

A critical vulnerability tracked as CVE-2026-32746 was disclosed in GNU InetUtils telnetd affecting version 2.7 and earlier, enabling pre-authentication remote code execution through a buffer overflow in the LINEMODE SLC handler. The flaw stems from a missing bounds check in the add_slc function, which can trigger an out-of-bounds memory write during the Telnet handshake before the login prompt is shown. Security reporting said a remote unauthenticated attacker could exploit the bug to execute code as root, resulting in full system compromise.

The issue was rated CVSS 9.8 and public proof-of-concept exploit code was reported as available, increasing the likelihood of exploitation against exposed Telnet services. Advisories urged organizations to treat internet-accessible telnetd instances as high risk and apply mitigations until patches are available, including restricting access to trusted IP addresses, blocking TCP port 23, or disabling Telnet entirely where it is not operationally required.