← Back to articles

A 32-year-old bug walks into a Telnet server

2026-09-16 | original

read original get Yubico YubiKey 5C NFC → more articles

Why This Matters

A 32-year-old pre-authentication buffer overflow (CVE-2026-32746) has just been discovered in the Telnet daemon code that underlies most Linux distributions' Telnetd implementations, showing how ancient, rarely-audited network services can still pose serious remote code execution risks. Even though Telnet has largely been supplanted by SSH, its lingering presence in legacy systems and embedded devices means this decades-old flaw could still be exploited widely before patches are applied.

Key Takeaways

CVE-2026-32746 is a pre-auth buffer overflow in the LINEMODE SLC negotiation handler of GNU inetutils' Telnetd, dating back to 1994.
Because most vendors based their Telnet implementations on the same code, the vulnerability affects a broad range of systems, including major Linux distributions.
Despite its severity and potential for remote code execution, the bug received little public analysis or attention in the week after disclosure, highlighting a gap in security research coverage for legacy protocols.

Worth a Look

Yubico YubiKey 5C NFC — This throwback Telnet vuln is a perfect reminder that plaintext remote access protocols and weak auth are still lurking in old infrastructure. A hardware security key like the YubiKey lets you lock down SSH and other remote access with strong, phishing-resistant authentication instead of relying on decades-old assumptions. It's a small, durable device that plugs straight into modern security practices for servers and accounts alike.

See Yubico YubiKey 5C NFC on Amazon → Affiliate link — we may earn a commission on purchases, at no extra cost to you. Product picked by AI based on this article; it is not a tested recommendation.

A long, long time ago, in a land free of binary exploit mitigations, when Unix still roamed the Earth, there lived a pre-authentication Telnetd vulnerability.

In fact, this vulnerability was born so long ago (way back in 1994) that it may even be older than you. To put the timespan in perspective: it came into existence the same year the seminal movie Hackers was released.

That was so long ago that RISC was still a distant dream.

Come to think of it, maybe it was even the product of Zero Cool himself?

Anyway. Recently, this vulnerability was brutally put to rest.

What Are We Looking At Here?

If you're not familiar with Telnet, that's okay.

Telnet is a network protocol that provides a command-line interface for communicating with a remote server over TCP/IP. In other words, remote code execution as a service. Typical setups do have an authentication barrier, requiring you to log in before you can access the system's shell. It also operates over plaintext, which means yes, it transmits your username and password across the network in the clear.

The de facto replacement these days is SSH, and Telnet is becoming increasingly uncommon.

What Is CVE-2026-32746?

... continue reading

Explore topics: cve-2026-32746 telnetd buffer overflow gnu inetutils linemode slc