CVE-2026-32746 - Vulnerability Details - OpenCVE

ReportizFlow

telnetd in GNU inetutils through 2.7 allows an out-of-bounds write in the LINEMODE SLC (Set Local Characters) suboption handler because add_slc does not check whether the buffer is full.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation none

Automatable yes

Technical Impact total

Vendors	Products
Gnu	Inetutils

No data.

No data.

References

Link	Providers
https://lists.gnu.org/archive/html/bug-inetutils/2026-03/msg00031.html
https://www.openwall.com/lists/oss-security/2026/03/12/4

History

Sun, 15 Mar 2026 02:15:00 +0000

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}`

Fri, 13 Mar 2026 21:30:00 +0000

Type	Values Removed	Values Added
First Time appeared		Gnu Gnu inetutils
CPEs		cpe:2.3:a:gnu:inetutils::::::::
Vendors & Products		Gnu Gnu inetutils

Fri, 13 Mar 2026 17:30:00 +0000

Type	Values Removed	Values Added
Description		telnetd in GNU inetutils through 2.7 allows an out-of-bounds write in the LINEMODE SLC (Set Local Characters) suboption handler because add_slc does not check whether the buffer is full.
Weaknesses		CWE-120
References		https://lists.gnu.org/archive/html/bug-inetutils/2026-03/msg00031.html https://www.openwall.com/lists/oss-security/2026/03/12/4
Metrics		cvssV3_1 `{'score': 9.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'}`

MITRE

Status: PUBLISHED

Assigner: mitre

Published: 2026-03-13T17:15:14.876Z

Updated: 2026-03-15T01:51:18.775Z

Reserved: 2026-03-13T17:15:14.405Z

Link: CVE-2026-32746

Vulnrichment

Updated: 2026-03-15T01:50:41.708Z

NVD

Status : Received

Published: 2026-03-13T19:55:10.147

Modified: 2026-03-13T19:55:10.147

Link: CVE-2026-32746

Redhat

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-32746", "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "state": "PUBLISHED", "assignerShortName": "mitre", "dateReserved": "2026-03-13T17:15:14.405Z", "datePublished": "2026-03-13T17:15:14.876Z", "dateUpdated": "2026-03-15T01:51:18.775Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unknown", "product": "inetutils", "vendor": "GNU", "versions": [{"lessThanOrEqual": "2.7", "status": "affected", "version": "0", "versionType": "custom"}]}], "descriptions": [{"lang": "en", "value": "telnetd in GNU inetutils through 2.7 allows an out-of-bounds write in the LINEMODE SLC (Set Local Characters) suboption handler because add_slc does not check whether the buffer is full."}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-120", "description": "CWE-120 Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre", "dateUpdated": "2026-03-13T21:04:53.288Z"}, "references": [{"url": "https://www.openwall.com/lists/oss-security/2026/03/12/4"}, {"url": "https://lists.gnu.org/archive/html/bug-inetutils/2026-03/msg00031.html"}], "x_generator": {"engine": "CVE-Request-form 0.0.1"}, "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:gnu:inetutils:*:*:*:*:*:*:*:*", "versionEndIncluding": "2.7"}]}]}]}, "adp": [{"title": "CVE Program Container", "references": [{"url": "http://www.openwall.com/lists/oss-security/2026/03/14/1"}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2026-03-14T02:55:48.456Z"}}, {"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-32746", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-03-14T03:55:33.337627Z"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-15T01:51:18.775Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"cna": {"metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "GNU", "product": "inetutils", "versions": [{"status": "affected", "version": "0", "versionType": "custom", "lessThanOrEqual": "2.7"}], "defaultStatus": "unknown"}], "references": [{"url": "https://www.openwall.com/lists/oss-security/2026/03/12/4"}, {"url": "https://lists.gnu.org/archive/html/bug-inetutils/2026-03/msg00031.html"}], "x_generator": {"engine": "CVE-Request-form 0.0.1"}, "descriptions": [{"lang": "en", "value": "telnetd in GNU inetutils through 2.7 allows an out-of-bounds write in the LINEMODE SLC (Set Local Characters) suboption handler because add_slc does not check whether the buffer is full."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-120", "description": "CWE-120 Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')"}]}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:gnu:inetutils:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndIncluding": "2.7"}], "operator": "OR"}]}], "providerMetadata": {"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre", "dateUpdated": "2026-03-13T21:04:53.288Z"}}, "adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-32746", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-03-14T03:55:33.337627Z"}}}], "providerMetadata": {"shortName": "CISA-ADP", "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "dateUpdated": "2026-03-15T01:50:41.708Z"}}]}, "cveMetadata": {"cveId": "CVE-2026-32746", "state": "PUBLISHED", "dateUpdated": "2026-03-13T21:04:53.288Z", "dateReserved": "2026-03-13T17:15:14.405Z", "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "datePublished": "2026-03-13T17:15:14.876Z", "assignerShortName": "mitre"}, "dataVersion": "5.2"}