9.8

CVE-2026-32746: gnu inetutils Classic Buffer Overflow

CVSS: 9.8v3.1CriticalAnalyzed
AliasesMGASA-2026-0122SUSE-SU-2026:0930-1UBUNTU-CVE-2026-32746
Published 13-03-2026Last modified 23-03-2026
Open JSON

Vulnerability summary

CVE-2026-32746 is a critical (CVSS 9.8) Classic Buffer Overflow vulnerability in gnu inetutils. EPSS estimates a 2.54% chance of exploitation in the next 30 days, higher than 84.7% of scored vulnerabilities. 3 public exploits are recorded.

Overall risk
70/100
0100
High · default modelHow is this calculated?
CVSS score
9.8/10
010
Critical · v3.1 (CVE.org)
EPSS score
2.54%
0%100%
Low · -21.13 pp in 30 days
KEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits3github, reference, exploit-database

Advisory lineage

Upstream 0 · Downstream 1 · Related 1
USN-8387-1

Timeline

  1. 13-03-2026
    PublishedVulnerability first disclosed.
  2. 23-03-2026
    Last modifiedVulnerability information updated.

Description

telnetd in GNU inetutils through 2.7 allows an out-of-bounds write in the LINEMODE SLC (Set Local Characters) suboption handler because add_slc does not check whether the buffer is full.

CVSS metrics

4 scores · 4 sources · 1 version

EPSS trend

Probability

2.54%

Chance of exploitation in the next 30 days

Percentile

85%

Versus all other CVEs

30-day change

-21.13 pp

From 23.67% on 20-09-2026

20-09-202620-10-2026
EPSS score
2.54%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

3 found
  • githubUnverified

    Watchtowr Vs Telnetd Cve 2026 32746

    Maturity: poc

  • referenceUnverified

    Exploit Reference (lists.gnu.org)

    Maturity: unknown

  • exploit-databaseremotemultipleUnverified

    telnetd 2.7 - Buffer Overflow

    Maturity: poc

Weaknesses

CWE · root cause

Affected systems

Opensuse2 products
  • krb5-appl&distro=openSUSE Leap 16.0< 1.0.3-bp160.2.1
  • krb5-appl&distro=openSUSE Tumbleweed< 1.0.3-6.1
Suse2 products
  • krb5-appl&distro=SUSE Linux Enterprise Server 12 SP5-LTSS< 1.0.3-3.12.1
  • krb5-appl&distro=SUSE Linux Enterprise Server LTSS Extended Security 12 SP5< 1.0.3-3.12.1
Debian1 product
  • inetutils< 2:2.4-2+deb12u3 | < 2:2.6-3+deb13u3 | < 2:2.7-4
Gnu1 product
Mageia1 product
  • krb5-appl< 1.0.3-16.1.mga9
Ubuntu1 product
  • inetutils< 2:1.9.2-1ubuntu0.1~esm4 | < 2:1.9.4-1ubuntu0.1~esm6 | < 2:1.9.4-3ubuntu0.1+esm5 | < 2:1.9.4-11ubuntu0.2+esm4 | < 2:2.2-2ubuntu0.2+esm1 | < 2:2.5-3ubuntu4.2 | < 2:2.6-1ubuntu3.2 | < 2:2.7-2ubuntu1.1

6 vendors · 8 products

References

14 links
Show all 14 references