CriticalPublic exploitVulnerability

CVE-2026-32746

Pre-authentication buffer overflow in GNU Inetutils telnetd LINEMODE SLC handling

Published Mar 13, 2026 · Updated 25 days ago

Trending this weekNot trendingOutside this week’s top 100

Mention activity · 30 days

1 mention · peak 1 in a dayToday

CVSS9.8Critical · v3.1

EPSS45.3%99th percentile

CISA KEVNoNot listed

In the wildNonePublic exploit, no exploitation reported

Vendor: GNU Project

IdentifiersCVE-2026-32746CWE-120 · Buffer Copy without Checking Size…

CVE-2026-32746 is a pre-authentication buffer overflow in GNU Inetutils telnetd through version 2.7. The add_slc function in the LINEMODE SLC (Set Local Characters) suboption handler appends data to a fixed-size buffer without checking available capacity. A remote, unauthenticated attacker can trigger out-of-bounds writes by supplying an oversized sequence of SLC triplets during initial Telnet negotiation, before the login prompt appears. Memory corruption can potentially lead to arbitrary code execution with the daemon's privileges. Reliable code execution is environment-dependent and has not been demonstrated universally. GNU Inetutils 2.8 fixes the vulnerability.

Do you run this?See affected versions in your environment and whether adversaries are exploiting this vulnerability against assets like yours.

Check your exposure

Analyst brief

Impact, mitigation & remediation

What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.

Impact

What an attacker gets, and what they’ve been doing with it.

Exploitation corrupts adjacent process memory and may cause service disruption, disclose internal pointers, or provide additional memory-corruption primitives. Testing demonstrated an arbitrary-free primitive on 32-bit Debian, while reliable remote code execution remained difficult on tested systems. If exploitation achieves code execution in a root-running telnetd process, the attacker can fully compromise host confidentiality, integrity, and availability. No active exploitation is confirmed in the available information.

Mitigation

If you can’t patch tonight, do this now.

Disable telnetd wherever possible. If Telnet must remain available, block external access to its listening port, normally TCP 23, and restrict access to explicitly trusted hosts through perimeter and host firewalls and network segmentation. Run telnetd without root privileges where operationally supported to reduce potential impact. Monitor network traffic for oversized LINEMODE SLC suboptions and retain connection logs and packet captures centrally; authentication logs alone are insufficient because the vulnerable processing occurs before login.

Remediation

Patch, then assume compromise.

Upgrade GNU Inetutils to version 2.8 or later, or install a distribution-supported package containing the CVE-2026-32746 fix. Alpine Linux users should update inetutils-telnet and related packages to 2.8-r0 or later. For affected Synology systems, install DSM 7.3.2-86009-3, DSM 7.2.2-72806-8, DSM 7.2.1-69057-11, or a newer applicable release. A DSMUC 3.1 fix was still under development in the available advisory; disable Telnet until a supported fix is available.

Public exploits

Exploits

5 exploits validated by Mallory's analysis. Hidden: 3 rejected by Mallory's analysis as not a working exploit; 1 not yet analyzed, such as Exploit-DB entries.

View more in app →

cve-2026-32746This repository is a standalone Python proof-of-concept for CVE-2026-32746, a pre-authentication buffer overflow in GNU InetUtils telnetd's LINEMODE SLC handler. It is not part of a larger exploit framework. The repository contains 8 files: two Python scripts (exploit and detector), a Docker-based lab environment, service configuration, and documentation. The main exploit is exploit.py. It connects to a Telnet server over TCP, performs initial Telnet option negotiation, proactively offers WILL LINEMODE, sends TTYPE and TSPEED suboptions to satisfy expected negotiation flow, and then transmits a malicious LINEMODE SLC suboption. The payload is built in build_slc_payload() and consists of repeated 3-byte SLC triplets whose function codes exceed NSLC=18. According to the code and README, this causes telnetd's add_slc() logic to queue repeated 'not supported' responses into a fixed buffer of about 104 usable bytes, overflowing it after roughly 35 triplets. The default exploit sends 60 triplets, aiming to corrupt the slcptr pointer and trigger a crash when end_slc() writes through the corrupted pointer. The script then checks for timeout, reset, or broken pipe to infer service crash. This is a pre-auth network attack vector against Telnet. The repository also includes detect.py, a non-destructive detection script. It performs similar Telnet negotiation but stops after checking whether the server accepts LINEMODE and begins SLC negotiation. It does not send the overflow payload and is intended for safer identification of likely vulnerable GNU InetUtils telnetd instances. The Dockerfile, docker-compose.yml, and xinetd-telnet.conf create a local lab environment using Debian bookworm-slim with inetutils-telnetd and xinetd. The container exposes Telnet on port 23 and docker-compose maps it to host port 2323. A test user is created for login verification, though the exploit itself is explicitly pre-authentication and does not require credentials. Overall, the repository's purpose is to demonstrate and validate the vulnerability by crashing the target service, not to provide full remote code execution. The README explicitly states that code execution is not implemented and outlines only high-level future steps for developing an RCE chain. As such, the exploit is best classified as an operational DoS/crash PoC with a basic, hardcoded protocol payload and a companion detection utility.jeffaf · Disclosed Mar 18, 2026 · python · dockerfile · networkOperational CVE-2026-32746-ExploitThis repository is a small exploit toolkit targeting GNU InetUtils telnetd with two pre-authentication issues: CVE-2026-24061 and CVE-2026-32746. It contains 10 files total, primarily Python plus one Bash scanner wrapper. The main structure is: two primary exploit implementations in exploits/exploit_cve_2026_24061.py and exploits/exploit_cve_2026_32746.py; three focused PoC/support scripts for CVE-2026-32746 (exploit_heap_ptr.py, exploit_rce.py, exploit_slctab_crash.py); a bulk scanner in exploits/scanner.py; and a shell-based parallel scanner in scan_telnetd.sh. CVE-2026-24061 exploit: a network Telnet exploit against TCP/23 that abuses Telnet NEW-ENVIRON negotiation. The code negotiates Telnet options, responds to NEW-ENVIRON requests, and injects USER="-f root" (or a custom string) so telnetd passes it into /usr/bin/login as a command-line argument. The intended result is authentication bypass and an immediate pre-auth root shell. The script supports at least check mode and interactive shell mode, making it more than a detector. CVE-2026-32746 exploit: a more advanced Telnet LINEMODE/SLC overflow exploit framework. It crafts malicious SLC triplets in Telnet subnegotiation to overflow slcbuf and corrupt adjacent BSS state. Repository descriptions indicate multiple capabilities: crash verification, probing, pointer corruption, arbitrary-write style primitives, and target-specific RCE by overwriting GOT/function pointers. The main exploit file exposes multiple modes such as crash, probe, rce, and verify-rce, and requires target-specific offsets or profiles for reliable code execution. This makes it operational but not fully weaponized. The auxiliary CVE-2026-32746 scripts document and demonstrate exploitation stages: exploit_slctab_crash.py aims for controlled SIGSEGV via slctab corruption; exploit_heap_ptr.py demonstrates corruption of I/O buffer pointers to redirect writes; exploit_rce.py chains several primitives and explicitly assumes a fixed target layout (GNU inetutils telnetd 2.5, ASLR disabled, known binary/libc bases). These files are useful for exploit development and validation rather than generic one-click exploitation. The scanner.py script performs bulk scanning of targets from a file or stdin, checks TCP connectivity, invokes the exploit classes directly, and records whether CVE-2026-24061 yields RCE and whether CVE-2026-32746 appears vulnerable/crashable or RCE-capable. The Bash script scan_telnetd.sh wraps the two main Python exploits for parallelized scanning and CSV output. Overall, the repository’s purpose is offensive security research and validation of pre-auth Telnet daemon vulnerabilities, with both exploitation and scanning workflows centered on GNU inetutils telnetd over TCP port 23.duduLiu8787 · Disclosed Mar 19, 2026 · python · bash · network · localOperational CVE-2026-32746This repository is a standalone Python exploit research repo for CVE-2026-32746, a pre-authentication buffer overflow in GNU InetUtils telnetd's LINEMODE SLC handling. It is not part of a larger exploit framework. The repo contains one safe detector, multiple exploit/research scripts, a Dockerized lab, and extensive writeups documenting exploitability limits. Structure and purpose: - detect.py: non-destructive network detector. It connects to a telnet service, performs option negotiation, offers WILL LINEMODE, sends TTYPE/TSPEED suboptions, and checks whether the server accepts LINEMODE and begins SLC negotiation. This is effectively a vulnerability detection/fingerprinting script. - exploit.py: main PoC DoS exploit. It negotiates telnet options, enters LINEMODE, then sends a crafted SLC suboption with many triplets (default 60) to overflow the fixed SLC response buffer and crash or hang telnetd. This is the clearest operational exploit in the repo. - exploit_leak.py: info-leak exploit. It performs fuller telnet negotiation, waits for the server SLC suboption, sends an overflow payload, and parses the oversized SLC response to recover the slcptr value from offset 112, then derives the PIE base. This demonstrates reliable pre-auth memory disclosure. - exploit_aslroff.py: staged research exploit for ASLR-off/known-base conditions. It combines PIE leak, controlled BSS write positioning, and deferred free/corruption experiments to show post-overflow effects, but not working RCE. - exploit_bruteforce.py: analysis script testing whether partial pointer overwrite/brute force is viable. It concludes GCC register optimization prevents arbitrary slcptr control and that brute force is unnecessary because the info leak is reliable. - exploit_file_struct.py: the most detailed RCE feasibility analysis. It maps BSS targets and evaluates multiple candidate control-flow hijack paths (decrypt_input overwrite, authenticated pointer redirection, glibc hooks, FSOP, etc.), concluding RCE is blocked on Debian 12 / glibc 2.36 / Full RELRO / PIE / NX. - exploit_rce_attempt.py: earlier precision-write attempt script. Based on the repository findings, some of its assumptions about arbitrary slcptr control appear superseded by later corrected analysis. - Dockerfile, docker-compose.yml, xinetd-telnet.conf: self-contained vulnerable lab using Debian bookworm, inetutils-telnetd under xinetd, exposed on host port 2323. - FINDINGS.md and SUMMARY_EN.md: extensive technical analysis documenting the bug, BSS layout, leak primitive, constrained 2-byte write primitive, and why modern hardened targets do not reach RCE. Main exploit capabilities extracted from the code and documentation: 1. Pre-auth remote detection/fingerprinting of likely vulnerable GNU InetUtils telnetd via LINEMODE/SLC negotiation. 2. Pre-auth remote denial of service by overflowing the SLC buffer and causing telnetd to crash or stop responding. 3. Pre-auth remote information disclosure: oversized SLC response leaks BSS contents including a PIE-relative pointer, allowing calculation of the binary base. 4. Constrained memory corruption/write primitive: end_slc() writes fixed bytes 0xFF 0xF0 at a BSS offset determined by triplet count/alignment, with additional corruption of adjacent BSS variables such as slcchange, def_slclen, and def_slcbuf. 5. Research-only exploration of secondary effects such as invalid free() and function-pointer corruption, but no demonstrated working shell or arbitrary code execution on the documented modern target. Network behavior and targets: All active scripts are network-based and target a telnet service over TCP, defaulting to port 23 unless overridden. The lab maps host TCP/2323 to container TCP/23. The scripts implement telnet option negotiation using IAC/DO/WILL/WONT/DONT/SB/SE and specifically interact with LINEMODE (0x22), TTYPE (0x18), TSPEED (0x20), and in some scripts NAWS (0x1F). The exploit payload is a malicious LINEMODE SLC suboption (LM_SLC = 0x03) containing many SLC triplets with function codes greater than NSLC (18). Overall assessment: This is a real exploit repository with working network PoCs and a lab environment. The most credible demonstrated outcomes are detection, reliable pre-auth DoS, and reliable pre-auth PIE/base leakage. The repository's own later analysis strongly indicates that full RCE is not achieved on modern hardened Debian bookworm targets, making the repo operational for crash/leak exploitation but primarily research-oriented for deeper code-execution attempts.chosenonehacks · Disclosed Mar 20, 2026 · python · dockerfile · network · remote pre-authenticationOperational telnet_scanThis repository is a small standalone Python exploit/scanner project, not part of a larger framework. It contains one executable code file, `telnet_scan.py`, plus a README and license. The script is an interactive Telnet assessment tool targeting two claimed GNU InetUtils telnetd vulnerabilities: CVE-2026-24061 and CVE-2026-32746. Repository structure is simple: `telnet_scan.py` is the main and only code artifact; `README.md` documents installation, menu-driven usage, batch scanning, expected output, and mitigation guidance. The Python script uses standard library modules only (`socket`, `select`, `termios`, `tty`, `signal`, etc.), indicating a self-contained network tool. Core capabilities observed in the code and documentation: - Validates whether a target Telnet service is reachable before testing. - Supports single-target and file-based batch scanning. - Attempts CVE-2026-24061 by negotiating Telnet NEW_ENVIRON and sending a subnegotiation that sets `USER` to `-f root`. - Detects likely shell access by checking returned banner/output for shell-like prompts such as `#`, `$`, `>`, or `root@`. - If successful, drops the operator into an interactive shell over the existing socket using raw terminal mode. - Tests CVE-2026-32746 by negotiating LINEMODE and sending an oversized SLC-style payload intended to trigger a pre-authentication buffer overflow; success is inferred from connection drop/crash behavior rather than code execution. The exploit is best characterized as OPERATIONAL rather than a mere PoC because it includes working network logic, target validation, batch processing, and an interactive post-exploitation shell path for the auth-bypass case. However, it is not obviously weaponized or framework-integrated. Fingerprintable network/protocol indicators are limited because targets are user-supplied at runtime rather than hardcoded. The main identifiable target surface is TCP/23 (Telnet). Protocol-level indicators include Telnet option 39 (NEW_ENVIRON), option 34 (LINEMODE), and the injected string `USER=-f root`. The README also references `/usr/bin/login` as the downstream component affected by the environment injection. No hardcoded external C2, callback URLs, domains, or IP addresses are present in the code.ekomsSavior · Disclosed Mar 26, 2026 · python · markdown · networkOperational KangarooSmall standalone Go exploit repository consisting of one executable source file (Kangaroo.go), a README, and a license. The code is not part of a known exploitation framework. The main program performs a direct TCP connection to a user-specified target on port 23/Telnet, sends a fixed credential string ('user\r\n'), then immediately transmits a hardcoded shellcode blob. After sending the payload, it waits briefly and reads up to 1024 bytes of response data, suggesting the author expects a shell prompt or other post-exploitation output. Repository structure is minimal: README.md describes the tool as an authentication-bypass exploit for Telnet servers 'running 2.7 or lower' and references CVE-2026-32746; Kangaroo.go contains all exploit logic; LICENSE is standard MIT text. There is no scanning, target discovery, payload customization, argument parsing, or reliability logic. The exploit is therefore best characterized as a basic proof-of-use exploit with an embedded operational payload rather than a detection script. Notable capabilities: network-based exploitation over Telnet/TCP 23, transmission of a hardcoded shell-spawning payload, and simple response capture from the target. Notable limitations: target IP must be edited in source, no validation of vulnerability state, no authentication negotiation beyond sending a static username, and no interactive shell handling. The shellcode includes '/bin/sh', which strongly indicates intended remote shell execution on Unix-like targets.MonkeySeC-sys · Disclosed Aug 2, 2026 · go · markdown · networkOperational

Exposure surface

Affected products & vendors

Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.

VendorProductType

GNU ProjectInetutilsapplication

External references

References

MITRE CVEcve.org · CVE-2026-32746 NVDnvd.nist.gov/vuln/detail/CVE-2026-32746 MITRE CWE · CWE-120Buffer Copy without Checking Size of Input…Vendor Advisorylists.gnu.org/archive/html/bug-inetutils/2026-03/msg00031.html Third Party Advisoryopenwall.com/lists/oss-security/2026/03/14/1 Third Party Advisorygithub.com/watchtowrlabs/watchtowr-vs-telnetd-CVE-2026-32746 Third Party Advisoryopenwall.com/lists/oss-security/2026/03/12/4

Activity feed

Recent activity

155 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

View more in app →

tenable cloud security pluginsNews · Oct 16, 2026Alpine: multiple inetutils-telnet packages: security update to... | Tenable®An out-of-bounds write affects the LINEMODE SLC suboption handler in GNU Inetutils telnetd through version 2.7 because add_slc lacks a buffer-full check. Update Alpine inetutils-telnet and related packages to 2.8-r0 or later.Read more ↗medium mainekhackerNews · Sep 10, 2026Orion HTB Room Full Walkthought | by MainEkHacker | Sep, 2026 | MediumAn out-of-bounds-write flaw in GNU inetutils telnetd's LINEMODE Set Local Characters handler, affecting telnetd through 2.7. The target was confirmed vulnerable with a detection artifact, but this walkthrough did not exploit it for code execution.Read more ↗cyber security newsNews · Mar 26, 2026Synology DiskStation Manager Vulnerability Allow Remote Attackers to Execute Arbitrary CommandsA critical unauthenticated remote command execution vulnerability in the telnetd daemon of GNU Inetutils, affecting Synology DiskStation Manager environments via improper handling of the LINEMODE SLC suboption that leads to a buffer overflow and out-of-bounds write.Read more ↗watchtowr labsNews · Mar 19, 2026A 32-Year-Old Bug Walks Into A Telnet Server (GNU inetutils Telnetd CVE-2026-32746 Pre-Auth RCE)A pre-authentication BSS-based buffer overflow in Telnetd's LINEMODE SLC negotiation handler, affecting GNU inetutils and many derived Telnetd implementations, with potential for memory corruption and possible remote code execution depending on target-specific memory layout.Read more ↗

+7 more in the timeline. Sign up to see them

Do you run this?See affected versions in your environment and whether adversaries are exploiting this vulnerability against assets like yours.

Check your exposure

Mallory platform

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets are affected, which adversaries are exploiting it right now, and which detections to deploy tonight.

Start Free Trial Open in App ↗

Exposure mappingQuery your assets running an affected version, and investigate the blast radius.

Threat actor evidenceEvery report linking this CVE to a named adversary.

Associated malwareMalware families linked to this CVE, with evidence and IOCs.

Detection signatures2YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

Vendor-by-vendor mappingCross-references every affected SKU, including bundled OEM variants.

Social activity142Community discussion across Reddit, Mastodon, and other social sources.