A critical vulnerability in the widely-used GNU Telnet server software allows attackers to gain full control of vulnerable systems with a single network connection, requiring no login credentials or user interaction. The flaw, a buffer overflow in the server’s handling of the LINEMODE SLC (Set Local Characters) option, has prompted security researchers to warn of potentially widespread risk, particularly for older systems and those with exposed Telnet interfaces. The vulnerability, tracked as CVE-2026-32746, affects all versions of GNU Inetutils through 2.7 and potentially other Telnet implementations derived from the BSD codebase.
The issue centers around a fixed-size buffer within the Telnet server code. According to a message posted to a GNU mailing list on March 11, 2026, the “SLC response is built in a fixed 108-byte buffer, slcbuf, with only 104 bytes used for data after a 4-byte header.” The server’s code, specifically the add_slc function (lines 162-175), appends data to this buffer without verifying if it’s already full. This allows a malicious actor to send a crafted Telnet packet containing a large number of SLC triplets, exceeding the buffer’s capacity and overwriting adjacent memory. This type of vulnerability, known as a buffer overflow, is a classic method for gaining unauthorized control of a system.
How the Vulnerability Works
The vulnerability is triggered during the Telnet “handshake” process, before a user even logs in. As explained in a security advisory from Dream, a cybersecurity firm researching the vulnerability, the server queues a “not supported” reply for each SLC triplet received from the client. “After about 35 triplets […] the 104-byte space is exceeded and the code writes past the end of slcbuf,” the advisory states. This overwrites critical data, including a pointer called slcptr. When the server attempts to finalize the SLC exchange, it uses the corrupted slcptr, leading to an “arbitrary write” – meaning the attacker can write data to almost any location in the server’s memory. This arbitrary write capability can then be exploited to execute malicious code.
A proof-of-concept (PoC) exploit, available on GitHub, demonstrates the vulnerability by crashing the Telnet server. While the current PoC doesn’t achieve full code execution, researchers emphasize that it confirms the vulnerability’s existence and potential for remote code execution. The GitHub repository details how to build a vulnerable lab environment using Docker and test the exploit.
Who is at Risk?
The potential impact of this vulnerability is significant. Because Telnet servers often run with root privileges (the highest level of access on a Unix-like system), a successful exploit could grant an attacker complete control over the compromised machine. Dream’s advisory identifies several categories of vulnerable systems:
- Embedded systems and IoT devices with exposed Telnet interfaces
- Servers and appliances listening on TCP port 23 using the vulnerable codebase
- Linux distributions that ship with inetutils and have telnetd enabled or installable, including Debian, Ubuntu, Red Hat Enterprise Linux (RHEL), and SUSE.
The ease of exploitation is particularly concerning. “A single network connection to port 23 is sufficient to trigger the vulnerability. No credentials, no user interaction, and no special network position are required,” Dream stated. In other words any system accessible over the internet with an open Telnet port is potentially at risk.
Mitigation and Patching
The maintainers of GNU Inetutils have prepared a patch to address the vulnerability, with plans to release it by April 1, 2026, according to Dream’s advisory. Until the patch is available, several workarounds are recommended:
- Migrate to SSH: Secure Shell (SSH) is a much more secure alternative to Telnet and should be used whenever possible.
- Disable Telnet: If Telnet is not required, disable the service entirely.
- Run Telnet Without Root Privileges: If Telnet must remain enabled, configure it to run with limited user privileges.
- Block Port 23: Restrict access to port 23 at the network perimeter, allowing connections only from trusted hosts.
Security experts strongly advise system administrators to prioritize patching or implementing these workarounds as soon as possible to mitigate the risk posed by this critical Telnet vulnerability. The vulnerability highlights the ongoing importance of secure configuration and the need to replace outdated protocols like Telnet with more secure alternatives.
Updates on the patch availability and further analysis of the vulnerability can be found on the GNU mailing list (https://lists.gnu.org/archive/html/bug-inetutils/2026-03/msg00031.html) and Dream’s vulnerability advisory (https://dreamgroup.com/vulnerability-advisory-pre-auth-remote-code-execution-via-buffer-overflow-in-telnetd-linemode-slc-handler/). The next scheduled update from the GNU Inetutils team is expected before the end of March.
Have thoughts on this developing story? Share your comments below and let us grasp how this vulnerability impacts your organization.
