CVE-2026-32746 Memory corruption in inetutils

Critical 9.8 Published 13 Mar 2026 Updated 23 Mar 2026

An out-of-bounds write in GNU inetutils telnetd allows attackers to execute arbitrary code or cause a denial of service.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: Available

What is CVE-2026-32746?

CVE-2026-32746 is a critical memory corruption vulnerability in GNU inetutils, published on 13 Mar 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

telnetd in GNU inetutils through 2.7 allows an out-of-bounds write in the LINEMODE SLC (Set Local Characters) suboption handler because add_slc does not check whether the buffer is full.

Weakness: CWE-120

Which versions are affected by CVE-2026-32746?

It affects 1 product.

Linux distribution packages (4)

`krb5-appl` SUSE:Linux Enterprise Server 12 SP5-LTSS	All versions	`1.0.3-3.12.1`
`krb5-appl` SUSE:Linux Enterprise Server LTSS Extended Security 12 SP5	All versions	`1.0.3-3.12.1`
`krb5-appl` openSUSE:Leap 16.0	All versions	`1.0.3-bp160.2.1`
`krb5-appl` openSUSE:Tumbleweed	All versions	`1.0.3-6.1`

Products include Gnu Inetutils.

How do I fix CVE-2026-32746?

Apply the vendor's patch.

Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.

Is CVE-2026-32746 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-32746 exists.

Public exploit code: 1 Exploit-DB entry and 7 proofs of concept on GitHub.

Sources

Also known as DEBIAN-CVE-2026-32746, GHSA-qvfm-56cp-4988, MGASA-2026-0122, SUSE-SU-2026:0930-1, UBUNTU-CVE-2026-32746, openSUSE-SU-2026:10657-1 and 1 more.