CVE-2026-32746: Critical severity GNU InetUtils vulnerability
Last updated 8 June 2026
Other sources
telnetd in GNU inetutils through 2.7 allows an out-of-bounds write in the LINEMODE SLC (Set Local Characters) suboption handler because addslc does not check whether the buffer is full.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/inetutilsto a version that resolves this vulnerability.Fixed in 2:2.0-1+deb11u4Fixed in 2:2.4-2+deb12u3Fixed in 2:2.6-3+deb13u3Fixed in 2:2.8-2 - Upgrade
Upgrade
alpine/inetutils-telnetto a version that resolves this vulnerability.Fixed in 2.8-r0
Event History
Frequently Asked Questions
What is the severity of CVE-2026-32746?
CVE-2026-32746 is classified as a high severity vulnerability due to the potential for out-of-bounds write which can lead to code execution.
How do I fix CVE-2026-32746?
To fix CVE-2026-32746, update GNU inetutils to version 2.8 or later, where the issue has been addressed.
What versions of GNU inetutils are affected by CVE-2026-32746?
GNU inetutils versions prior to 2.8 are affected by CVE-2026-32746.
What is the impact of CVE-2026-32746 on affected systems?
CVE-2026-32746 allows an attacker to exploit an out-of-bounds write, potentially leading to system instability or unauthorized code execution.
Is there a workaround for CVE-2026-32746 if I cannot upgrade GNU inetutils?
A potential workaround for CVE-2026-32746 is to disable the telnet service temporarily until an upgrade is possible.