Stack-based buffer overflow in Inetutils - GNU network utilities - CVE-2026-32746

Vulnerability identifier: #VU144357

CSH Severity: High

CVSS v4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2026-32746

CWE-ID: CWE-121

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to execute arbitrary code.

The vulnerability exists due to a stack-based buffer overflow in telnetd when processing an SLC suboption with many triplets using function octets greater than 18. A remote attacker can send a specially crafted telnet request to execute arbitrary code.

Inetutils - GNU network utilities
SUSE Linux Enterprise Server 12 SP5 LTSS Extended
SUSE Linux Enterprise Server 12 SP5
SUSE Linux Enterprise Server for SAP Applications 12
SUSE Linux Enterprise Server 12
SUSE Linux Enterprise High Performance Computing 12
LANTIME Operating System Firmware (LTOS)
krb5-appl-servers
krb5-appl-clients-debuginfo
krb5-appl-servers-debuginfo
krb5-appl-clients
krb5-appl-debugsource

Install security update from vendor's website.

Inetutils - GNU network utilities - update to 2.8
LANTIME Operating System Firmware (LTOS) - update to 7.10.012
krb5-appl-servers - update to 1.0.3-3.12.1
krb5-appl-clients-debuginfo - update to 1.0.3-3.12.1
krb5-appl-servers-debuginfo - update to 1.0.3-3.12.1
krb5-appl-clients - update to 1.0.3-3.12.1
krb5-appl-debugsource - update to 1.0.3-3.12.1

• https://seclists.org/oss-sec/2026/q2/289
• https://lists.gnu.org/r/bug-inetutils/2026-03/msg00031.html

• Multiple vulnerabilities in Inetutils - GNU network utilities
• Multiple vulnerabilities in Meinberg LANTIME Operating System Firmware
• SUSE update for krb5-appl