Out-of-bounds Write Affecting inetutils package, versions [,2.8)
Threat Intelligence
Snyk has a proof-of-concept or detailed explanation of how to exploit this vulnerability.
The probability is the direct output of the EPSS model, and conveys an overall sense of the threat of exploitation in the wild. The percentile measures the EPSS probability relative to all known EPSS scores. Note: This data is updated daily, relying on the latest available EPSS model version. Check out the EPSS documentation for more details.
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk IDSNYK-UNMANAGED-INETUTILS-15680353
- published18 Mar 2026
- disclosed10 Mar 2026
- creditAdiel Sol, Arad Inbar, Erez Cohen, Nir Somech, Ben Grinberg, Daniel Lubel
Introduced: 10 Mar 2026
CVE-2026-32746 (opens in a new tab)How to fix?
Upgrade inetutils to version 2.8 or higher.
Overview
Affected versions of this package are vulnerable to Out-of-bounds Write due to a buffer overflow in the add_slc() function in the LINEMODE SLC suboption handler. An attacker can achieve arbitrary code execution with the privilege of the telnetd service by sending a malicious SLC suboption with many triplets over telnet.
PoC
Start GNU Inetutils telnetd (e.g. with inetd or run telnetd manually) so it listens on port 23.
From another machine, connect to the telnet port and complete the initial handshake. When the server sends DO LINEMODE, reply with WILL LINEMODE so the server enters LINEMODE negotiation.
Send a single LINEMODE SLC suboption containing at least 40 to 50 triplets, each with a function code greater than 18 (e.g. 19, 20, 21, ... 68). Each triplet is 3 bytes (func, flag, value). Use 0x00 for flag and value. The suboption must be properly framed with IAC SB LINEMODE LM_SLC at the start and IAC SE at the end.
The server will call add_slc() for each triplet. After about 35 triplets it will write past the end of slcbuf. You should observe a crash, or (if you craft the overflow) memory corruption and possibly code execution.