CVE-2026-32746: Pre-Auth BSS Buffer Overflow in GNU inetutils telnetd LINEMODE SLC Handling — Threadlinqs Intelligence
As of 2026-07-19, CVE-2026-32746: Pre-Auth BSS Buffer Overflow in GNU inetutils telnetd LINEMODE SLC Handling is a high-severity vulnerability threat, tracked by Threadlinqs Intelligence with 9 detection rules (Splunk SPL, Microsoft KQL, Sigma) and 17 indicators of compromise.
Threat ID: TL-2026-1515 · Severity: HIGH · CVSS: 9.8 · Status: ACTIVE · Category: VULNERABILITY
A 32-year-old pre-authentication out-of-bounds write (CVE-2026-32746, CVSS 9.8) exists in GNU inetutils telnetd's LINEMODE SLC (Set Local/Linemode Characters) negotiation handler: add_slc() writes
GNU inetutils is a widely-embedded reimplementation of core BSD network utilities, including telnetd, shipped by Debian, Ubuntu, FreeBSD (13 and 15), NetBSD 10.1, DragonFlyBSD, Haiku, TrueNAS Core, uCLinux, Apple macOS Tahoe, Citrix NetScaler, and libmtev. CVE-2026-32746 is an out-of-bounds write (CWE-120) in the LINEMODE SLC suboption handler of telnetd.
During Telnet option negotiation, a client that advertises LINEMODE may send SLC (Set Local/Linemode Characters) suboption triplets (function byte, flag byte, value byte) that instruct the server how to map special terminal control characters. The server-side handler chain is process_slc() -> change_slc() -> add_slc(). add_slc() appends each accepted triplet directly into a fixed 0x6C-byte (108-byte) global BSS array, slcbuf, addressed via the slcptr pointer, with no check for remaining space. Validation performed in process_slc() constrains the function byte to <= 0x1E (NSLC) and specially handles a function byte of 0, and any literal 0xFF byte in the stream is doubled (IAC-style escaping) during storage — but none of this prevents slcptr from advancing past the end of slcbuf once more than roughly 35 accepted triplets (with function codes greater than 18/NSLC-adjacent range) have been supplied in a single negotiation, up to a maximum Telnet suboption packet size of 0x200 bytes (bounding overflow data to roughly 0x190 bytes).
Because slcbuf sits in BSS adjacent to other server-global state, the overflow corrupts approximately 400 bytes of surrounding memory, including the def_slcbuf pointer used for deferred SLC processing. watchTowr Labs showed that by (1) sending SLC data before the TTYPE response is completed (queuing it for deferred handling) and (2) then completing TTYPE negotiation — which sets terminit=1 and invokes deferslc(), which calls free(def_slcbuf) — an attacker who has first overwritten def_slcbuf via the slcbuf overflow can force telnetd to call free() on an attacker-controlled address, i.e., an arbitrary-free primitive. On 32-bit x86 Debian test targets this was demonstrated as reliable; researchers characterize it as "a very powerful primitive" but note that turning it into full remote code execution still requires defeating modern glibc heap allocator protections and is dependent on target memory layout, architecture, and compiler/allocator version. No authentication, and no user interaction beyond initiating a Telnet connection and completing standard option negotiation, is required — the bug triggers during pre-login protocol negotiation, before any login prompt is shown.
A nearly identical historical vulnerability, CVE-2005-0469, existed client-side in the analogous slc_add_reply() function in 2005; the 2026 finding is the long-lived server-side counterpart, dormant in the codebase since at least 1994. A separate, more easily exploitable prior GNU inetutils flaw (CVE-2026-24061, in environment-variable handling) was disclosed earlier in 2026 and is referenced by researchers as comparatively 'less far-reaching but considerably easier to exploit.'
An upstream fix (commit 6864598a29b652a6b69a958f5cd1318aa2b258af and later, in the Codeberg inetutils repository) adds a bounds check to add_slc() so that data which would overrun slcbuf is simply discarded rather than written. As of the 2026-03-19 watchTowr publication, the official inetutils 2.7 release remains vulnerable and only Debian's unstable/sid channel (package version 2:2.7-4) had shipped the patch; a wider patched release was expected around 2026-04-01. FreeBSD, NetBSD, DragonFlyBSD, Haiku, TrueNAS Core, uCLinux, macOS Tahoe, Citrix NetScaler and libmtev stable channels were unpatched at disclosure time. Censys measured approximately 3,362 Internet-exposed telnetd hosts as of 2026-03-18. No in-the-wild exploitation had been confirmed at time of writing; EPSS was measured at approximately 0.04%. watchTowr also published a non-invasive Telnet-negotiation-based detection/probe generator: vulnerable
Weaknesses (CWE)
CWE-120, CWE-787
Target sectors: government administration, telecoms, manufacturing, energy, industrialcontrolsystems, education, technology
Target regions: Global
Detections & IOCs
As of 2026-07-27, this threat has 9 detection rule(s) across Splunk SPL, Microsoft KQL and Sigma, and 17 indicator(s) of compromise. Detection query text and full IOC values are available to authenticated users and programmatically via the Threadlinqs MCP server (Purple tier). View plans.
VULNERABILITY, HIGH, threat intelligence, cybersecurity, CVE-2026-32746, T1595, T1590, T1588.006, T1587.004, T1190, T1203, T1505, T1068, T1211, T1046