GoKawiil32-Year-Old Buffer Overflow Found in GNU Inetutils Telnetd (CVE-2026-32746)
Researchers from the DREAM Security Research Team disclosed a pre-authentication buffer overflow in the LINEMODE SLC negotiation handler of GNU inetutils' Telnet server, a flaw dating back to 1994. Because many vendors' Telnetd implementations, including those in major Linux distributions, derive from the same codebase, the bug's reach extends well beyond a single project.
GoKawiil's interpretation of the reporting above, not reported fact.
Telnet's use has declined sharply due to its plaintext design, but legacy and embedded systems still run it, and a pre-auth memory corruption bug lets attackers compromise a device before any credentials are checked. The long dormancy of this flaw underscores how old, rarely audited network code can silently persist across countless downstream forks and distributions.
- A pre-authentication buffer overflow in GNU inetutils Telnetd has existed since 1994.
- The bug affects the LINEMODE SLC negotiation handler and can corrupt about 400 bytes of memory.
- Because many Telnetd implementations share this code, the vulnerability likely impacts numerous Linux distributions.
Source: labs.watchtowr.com, 2026-09-16
Published there as: “A 32-Year-Old Bug Walks into a Telnet Server”
Read the original report → The summary and analysis above are GoKawiil's own, written from reporting by the source above. Facts and quotes belong to the original publisher.