CVE-2026-32746: 1994-era pre-auth telnetd overflow reaches Linux, BSDs and appliances

A 1994 bug finally gets its CVE

Security firm watchTowr Labs has published a technical analysis of CVE-2026-32746, a buffer overflow in the Telnet server shipped with GNU inetutils that, according to the company, has been present in the code since 1994. The flaw was discovered by the DREAM Security Research Team, and watchTowr says it decided to publish its own write-up after almost a week passed with no thorough public analysis of the bug. The post subsequently reached the front page of Hacker News.

What makes the vulnerability stand out is where it sits: in the part of telnetd that handles protocol option negotiation, which runs before any user has logged in. An attacker who can reach the service over the network does not need valid credentials to trigger it.

How the overflow works

As watchTowr explains, Telnet is more than a raw TCP connection to a shell. The protocol supports in-band option negotiation driven by the IAC ('interpret as command') byte, 0xFF, through which client and server agree on features such as local echo, terminal window size and LINEMODE.

LINEMODE, standardised in RFC 1184, lets the client edit an entire line locally and send it in a single burst rather than one packet per keystroke — an optimisation from an age when some networks billed by the packet. Within LINEMODE sits SLC, 'set linemode characters', a mechanism in which the two endpoints exchange three-byte triplets specifying which control code should represent a special character such as backspace, along with a support level and a value.

The choreography works like this: once a TCP connection is established, the server requests LINEMODE (IAC DO LINEMODE); the client accepts (IAC WILL LINEMODE); the server sends its list of SLC triplets; and the client may reply with replacements of its own. The server writes those returned values into a fixed-size global array — with no bounds checking at all. That missing check, in place for more than three decades, is the vulnerability. The overflow is BSS-based and lets an attacker corrupt roughly 400 bytes of adjacent variables, according to the analysis.

Which systems are affected

The fix landed in inetutils-telnetd itself, but watchTowr stresses that vendors have long built their Telnet daemons on the same source, modifying and reusing it — and carrying the flaw along. The firm confirmed the vulnerable code in Ubuntu, Debian, FreeBSD 13 and the FreeBSD 15 port, NetBSD 10.1, DragonFlyBSD, Citrix NetScaler, Apple's macOS Tahoe, Haiku, TrueNAS Core, uCLinux and libmtev, and says the true extent is difficult to estimate given how many forks exist.

A fix the industry has already written once

There is precedent for this exact bug. CVE-2005-0469, from 2005, was essentially the same missing bounds check, only on the client side of the protocol, in a function called slc_add_reply. It was repaired with a bounds check identical in spirit to the one now applied to the server. watchTowr notes the irony: patching the client two decades ago never prompted anyone to audit the matching server code, so the twin survived until now.

Exploitation is less simple than it sounds

Despite the pre-authentication label, watchTowr cautions that converting this overflow into reliable code execution is more involved than it might appear, and its write-up examines the circumstances under which the bug is actually useful to an attacker. The firm also contrasts it with CVE-2026-24061, a separate recent Telnet flaw that abused the protocol's environment-variable forwarding for code execution; that bug was reportedly easier to exploit but far narrower in reach.

Why it matters

Telnet never quite died. watchTowr points out that production systems still run it for reasons ranging from vendor support policies to industrial equipment whose controllers cannot accommodate an SSH client, and that telnetd remains packaged in the repositories of every major Linux distribution. SSH is the modern replacement and Telnet sends credentials in cleartext, but that does not neutralise the installed base. A pre-authentication memory-corruption bug therefore has real targets — and they skew toward appliances, legacy servers and embedded gear, precisely the machines least likely to be patched quickly.

The affected code is also scattered across many independent forks, so no single vendor update resolves everything; each downstream project has to apply the fix itself, and some may never realise the CVE applies to them.

Finally, the episode is a lesson in code lineage. A bug fixed on the client in 2005 survived on the server until 2026 because nobody checked the sibling code path. For maintainers of anything descended from old Unix sources, the implication is uncomfortable: when a flaw turns up, the same audit probably needs to run everywhere the code was copied.