chosenonehacks/cve-2026-32746Proof-of-concept exploit for a pre-authentication buffer overflow in GNU InetUtils telnetd (CVE-2026-32746), including a Docker lab environment and detection script for authorized security testing.
Pre-authentication remote code execution via buffer overflow in GNU InetUtils telnetd's LINEMODE SLC (Set Local Characters) handler.
CVSS 3.1: 9.8 (Critical) | CWE: CWE-120, CWE-787
The add_slc() function in telnetd/slc.c appends 3 bytes per SLC triplet to a fixed 108-byte buffer (slcbuf) without bounds checking. An unauthenticated attacker can send a crafted SLC suboption with 40+ triplets (function codes > 18/NSLC) during option negotiation - before any login prompt - overflowing the buffer, corrupting the slcptr pointer in BSS, and achieving an arbitrary write when end_slc() uses the corrupted pointer.
# Build the vulnerable lab environment
docker compose up -d
# Detect (non-destructive)
python3 detect.py 127.0.0.1 2323
# Exploit (crashes telnetd - confirms vuln)
python3 exploit.py 127.0.0.1 2323
# Clean up
docker compose down
The Docker setup runs a Debian container with inetutils-telnetd 2.4 under xinetd, exposed on port 2323. Fully isolated - nothing touches your host.
WILL LINEMODE to trigger LINEMODE negotiationDO LINEMODE and enters SLC suboption processingadd_slc() queues a "not supported" reply (3 bytes) for each triplet into a 104-byte bufferslcptr and adjacent BSS dataend_slc() writes the suboption end marker via the corrupted slcptr (arbitrary write)| File | Description |
|---|---|
exploit.py | PoC crash/DoS exploit |
Dockerfile | Vulnerable telnetd lab |
docker-compose.yml | One-command lab setup |
xinetd-telnet.conf | xinetd service config |
detect.py | Non-destructive version detection script |
To go beyond DoS, you would need to:
slcbuf → slcptr offset)end_slc() writes via corrupted slcptrThis tool is provided for authorized security testing and educational purposes only. Do not use against systems you do not own or have explicit permission to test. The author is not responsible for misuse.
MIT