CVE-2026-32746: Pre-Auth BSS Buffer Overflow in GNU inetutils telnetd LINEMODE SLC Handling

CVE-2026-32746 (TL-2026-1515), also tracked as GNU inetutils telnetd LINEMODE SLC buffer overflow, is a high-severity software vulnerability scored CVSS 9.8, first published 2026-07-19. It has no confirmed attribution, affects GNU inetutils (telnetd), references 1 CVE (CVE-2026-32746), maps to 17 MITRE ATT&CK techniques (T1046, T1068, T1082), and is covered by 9 detection rules and 17 indicators of compromise.

Key facts for TL-2026-1515

Threat ID
TL-2026-1515
Also known as
GNU inetutils telnetd LINEMODE SLC buffer overflow, telnetd add_slc() out-of-bounds write
Severity
HIGH
CVSS
9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Status
ACTIVE
Category
VULNERABILITY
First published
2026-07-19
Last reviewed
2026-07-19
Attribution confidence
LOW
Motivation
UNKNOWN
Target sectors
government administration, telecoms, manufacturing, energy, industrialcontrolsystems, education, technology
Target regions
Global
Detection rules
9
Indicators of compromise
17

Malware and tooling in CVE-2026-32746

Malware and tooling: Exploit-DB 52556 (telnetd 2.7 buffer overflow), watchTowr detection/probe generator

A 32-year-old pre-authentication out-of-bounds write (CVE-2026-32746, CVSS 9.8) exists in GNU inetutils telnetd's LINEMODE SLC (Set Local/Linemode Characters) negotiation handler: add_slc() writes 3-byte client-supplied triplets into a fixed 108-byte (0x6C) global buffer (slcbuf) without checking whether the buffer is full, corrupting roughly 400 bytes of adjacent BSS memory including the def_slcbuf pointer. Israeli security firm Dream discovered and reported the flaw on 2026-03-11; watchTowr Labs' public technical analysis (2026-03-19) demonstrated a working arbitrary-free primitive on 32-bit x86 targets via def_slcbuf pointer corruption, and an independently-verified exploit-db PoC exists, though full generic RCE remains memory-layout dependent.

How CVE-2026-32746 works

GNU inetutils is a widely-embedded reimplementation of core BSD network utilities, including telnetd, shipped by Debian, Ubuntu, FreeBSD (13 and 15), NetBSD 10.1, DragonFlyBSD, Haiku, TrueNAS Core, uCLinux, Apple macOS Tahoe, Citrix NetScaler, and libmtev. CVE-2026-32746 is an out-of-bounds write (CWE-120) in the LINEMODE SLC suboption handler of telnetd.

During Telnet option negotiation, a client that advertises LINEMODE may send SLC (Set Local/Linemode Characters) suboption triplets (function byte, flag byte, value byte) that instruct the server how to map special terminal control characters. The server-side handler chain is process_slc() -> change_slc() -> add_slc(). add_slc() appends each accepted triplet directly into a fixed 0x6C-byte (108-byte) global BSS array, slcbuf, addressed via the slcptr pointer, with no check for remaining space. Validation performed in process_slc() constrains the function byte to <= 0x1E (NSLC) and specially handles a function byte of 0, and any literal 0xFF byte in the stream is doubled (IAC-style escaping) during storage — but none of this prevents slcptr from advancing past the end of slcbuf once more than roughly 35 accepted triplets (with function codes greater than 18/NSLC-adjacent range) have been supplied in a single negotiation, up to a maximum Telnet suboption packet size of 0x200 bytes (bounding overflow data to roughly 0x190 bytes).

Because slcbuf sits in BSS adjacent to other server-global state, the overflow corrupts approximately 400 bytes of surrounding memory, including the def_slcbuf pointer used for deferred SLC processing. watchTowr Labs showed that by (1) sending SLC data before the TTYPE response is completed (queuing it for deferred handling) and (2) then completing TTYPE negotiation — which sets terminit=1 and invokes deferslc(), which calls free(def_slcbuf) — an attacker who has first overwritten def_slcbuf via the slcbuf overflow can force telnetd to call free() on an attacker-controlled address, i.e., an arbitrary-free primitive. On 32-bit x86 Debian test targets this was demonstrated as reliable; researchers characterize it as "a very powerful primitive" but note that turning it into full remote code execution still requires defeating modern glibc heap allocator protections and is dependent on target memory layout, architecture, and compiler/allocator version. No authentication, and no user interaction beyond initiating a Telnet connection and completing standard option negotiation, is required — the bug triggers during pre-login protocol negotiation, before any login prompt is shown.

A nearly identical historical vulnerability, CVE-2005-0469, existed client-side in the analogous slc_add_reply() function in 2005; the 2026 finding is the long-lived server-side counterpart, dormant in the codebase since at least 1994. A separate, more easily exploitable prior GNU inetutils flaw (CVE-2026-24061, in environment-variable handling) was disclosed earlier in 2026 and is referenced by researchers as comparatively 'less far-reaching but considerably easier to exploit.'

An upstream fix (commit 6864598a29b652a6b69a958f5cd1318aa2b258af and later, in the Codeberg inetutils repository) adds a bounds check to add_slc() so that data which would overrun slcbuf is simply discarded rather than written. As of the 2026-03-19 watchTowr publication, the official inetutils 2.7 release remains vulnerable and only Debian's unstable/sid channel (package version 2:2.7-4) had shipped the patch; a wider patched release was expected around 2026-04-01. FreeBSD, NetBSD, DragonFlyBSD, Haiku, TrueNAS Core, uCLinux, macOS Tahoe, Citrix NetScaler and libmtev stable channels were unpatched at disclosure time. Censys measured approximately 3,362 Internet-exposed telnetd hosts as of 2026-03-18. No in-the-wild exploitation had been confirmed at time of writing; EPSS was measured at approximately 0.04%. watchTowr also published a non-invasive Telnet-negotiation-based detection/probe generator: vulnerable servers silently accept out-of-bounds SLC data and echo an injected 'unusual value' back to the prober along with a leaked heap pointer (e.g. slcptr), while patched servers silently drop the excess data — the tool includes a low-risk 'probe mode' that only checks whether LINEMODE is advertised, to avoid triggering the overflow on fragile legacy/industrial equipment that may still run exposed Telnet services.

MITRE ATT&CK techniques used in TL-2026-1515

Discovery

T1046 Network Service Discovery; T1082 System Information Discovery

Privilege Escalation

T1068 Exploitation for Privilege Escalation

Command and Control

T1095 Non-Application Layer Protocol

Initial Access

T1190 Exploit Public-Facing Application

Execution

T1203 Exploitation for Client Execution

Lateral Movement

T1210 Exploitation of Remote Services

Defense Evasion

T1211 Exploitation for Stealth

Impact

T1499 Endpoint Denial of Service; T1499.004 Application or System Exploitation

Persistence

T1505 Server Software Component

Resource Development

T1587.004 Exploits; T1588.006 Vulnerabilities

Reconnaissance

T1590 Gather Victim Network Information; T1592.002 Software; T1595 Active Scanning; T1596.005 Scan Databases

Affected products and versions in CVE-2026-32746

  • GNU — inetutils (telnetd)
    Vulnerable versions: 0 through 2.7
    Fixed in: post-commit 6864598a29b652a6b69a958f5cd1318aa2b258af (Debian unstable 2:2.7-4)
  • Debian — inetutils-telnetd
    Vulnerable versions: stable channel as of 2026-03-19
    Fixed in: unstable/sid 2:2.7-4
  • Ubuntu — inetutils-telnetd
    Vulnerable versions: shipped builds as of disclosure
  • FreeBSD — telnetd
    Vulnerable versions: 13.x; 15.x
  • NetBSD — telnetd
    Vulnerable versions: 10.1
  • DragonFlyBSD — telnetd
    Vulnerable versions: shipped builds as of disclosure
  • Haiku — telnetd
    Vulnerable versions: shipped builds as of disclosure
  • iXsystems — TrueNAS Core
    Vulnerable versions: shipped builds as of disclosure
  • uClinux-dist — uCLinux telnetd
    Vulnerable versions: shipped builds as of disclosure
  • Apple — macOS Tahoe
    Vulnerable versions: bundled telnetd as of disclosure

Remediation for CVE-2026-32746

Patches

  • Apply upstream inetutils fix commit 6864598a29b652a6b69a958f5cd1318aa2b258af (adds bounds check to add_slc()) once available for your distribution/vendor build
  • Debian unstable/sid package 2:2.7-4 already contains the fix; track backport to Debian stable and derivative distros

Immediate actions

  • Disable telnetd on all reachable hosts unless there is a hard operational requirement for it
  • Block inbound TCP/23 at perimeter and host-based firewalls, restricting any required Telnet access to trusted management networks only
  • Run telnetd, where it must remain enabled, without root privileges and under a restrictive service supervisor/sandbox to limit arbitrary-free/RCE blast radius
  • Inventory exposed Telnet services with Censys/Shodan-style external scanning and prioritize remediation of Internet-facing hosts first

Workarounds

  • Disable LINEMODE support in telnetd configuration where the implementation allows it, to remove the vulnerable code path from negotiation
  • Use watchTowr Labs' published non-invasive probe-mode detection tool to identify LINEMODE-advertising, potentially vulnerable hosts prior to remediation without triggering the overflow

Longer-term hardening

  • Migrate remaining Telnet use cases (legacy network gear, ICS/embedded consoles) to SSH or another authenticated, encrypted management protocol
  • Deploy network segmentation isolating any devices that cannot be moved off Telnet from general-purpose network access
  • Track distro/vendor patch rollout (Debian, Ubuntu, FreeBSD, NetBSD, DragonFlyBSD, Haiku, TrueNAS Core, uCLinux, macOS, Citrix NetScaler, libmtev) and apply updates as they ship
  • Add continuous external-attack-surface monitoring for newly exposed Telnet listeners

CVEs associated with CVE-2026-32746

CVE-2026-32746

Weaknesses (CWE) in CVE-2026-32746

CWE-120, CWE-787

Timeline of CVE-2026-32746

  • Unbounded add_slc() write into the fixed 108-byte slcbuf global buffer is introduced into the telnetd LINEMODE SLC negotiation code, later inherited by GNU inetutils; the bug remains dormant and unnoticed for roughly three decades.
  • CVE-2005-0469 discloses an analogous client-side buffer overflow in the slc_add_reply() function of Telnet clients, foreshadowing the server-side flaw found in 2026.
  • Dream (Israeli cybersecurity company) discovers and reports the unauthenticated telnetd LINEMODE SLC out-of-bounds write, subsequently assigned CVE-2026-32746.
  • CVE-2026-32746 is published in NVD with CVSS v3.1 base score 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) and CWE-120 classification.
  • Censys measures approximately 3,362 Internet-exposed telnetd hosts and publishes an advisory with detection queries across its Platform, ASM, and Legacy Search interfaces.
  • The Hacker News, CyCognito, Cybersecurity News, heise online, and other outlets publish coverage summarizing the critical unauthenticated RCE risk and exposed host counts.
  • A public proof-of-concept exploit for telnetd 2.7 is published to Exploit-DB (exploit 52556) and independently verified as reliably exploitable.
  • watchTowr Labs publishes a detailed technical writeup demonstrating a working arbitrary-free primitive via def_slcbuf pointer corruption on 32-bit x86 targets, plus a non-invasive Telnet-negotiation-based detection/probe tool.
  • A broader patched inetutils release incorporating fix commit 6864598a29b652a6b69a958f5cd1318aa2b258af is anticipated, following Debian unstable/sid's earlier fix in package version 2:2.7-4.

Sources cited for CVE-2026-32746

Threats related to CVE-2026-32746

Detection coverage for TL-2026-1515

As of 2026-07-19, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-1515 across Splunk SPL, Microsoft KQL and Sigma, covering 17 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.

Threadlinqs Intelligence — Real-Time Threat Detection Platform

[ 0 threats ] [ 0 det ] [ CRIT: 0 ] [ HIGH: 0 ]
// threat_feed
$ sort --newest
Showing all threats

Latest Threats