CVE-2026-32746: 
NixOS vulnerability analysis and mitigation

CVE-2026-32746 is a critical out-of-bounds write (buffer overflow) vulnerability in the telnetd daemon of GNU inetutils through version 2.7. The flaw exists in the LINEMODE SLC (Set Local Characters) suboption handler, where the add_slc function fails to verify whether the internal buffer is full before writing, enabling a heap/stack buffer overflow. It was publicly disclosed on March 12, 2026 via the oss-security mailing list and assigned CVE-2026-32746 by MITRE on March 13, 2026. The vulnerability carries a CVSS v3.1 base score of 9.8 (Critical) (oss-security, RedHat CVE).

The root cause is classified as CWE-120 (Buffer Copy without Checking Size of Input — Classic Buffer Overflow). During Telnet LINEMODE negotiation, the server processes SLC (Set Local Characters) suboptions sent by the client. The add_slc function in telnetd writes SLC triplets (function code, flag, value) into a fixed-size buffer without bounds checking, allowing a remote attacker to overflow the buffer by sending more than the expected number of triplets (e.g., 40–50 triplets with function codes greater than 18). This is exploitable pre-authentication, requiring no privileges or user interaction, over the network via TCP port 23. Detailed reproduction steps and PoC code are publicly available (GNU inetutils bug list, watchTowr Labs).

Successful exploitation allows an unauthenticated remote attacker to trigger an out-of-bounds write in the telnetd process, potentially enabling arbitrary code execution with the privileges of the telnetd daemon (often root). This results in full confidentiality, integrity, and availability compromise of the affected system. Systems running GNU inetutils telnetd — including Linux servers, NAS devices (e.g., Synology DiskStation Manager), and embedded/ICS/OT systems — are at risk of complete remote takeover, data exfiltration, and lateral movement within the network (watchTowr Labs, Industrial Cyber).

1. Reconnaissance: Identify internet-facing or network-accessible hosts running GNU inetutils telnetd (port 23/TCP) using tools like Shodan, Censys, or Nmap (nmap -p 23 --open <target>). Confirm the service is running inetutils telnetd version ≤ 2.7.
2. Establish Telnet connection: Connect to the target on TCP port 23 and complete the initial Telnet option negotiation handshake, including negotiating LINEMODE (IAC DO LINEMODE / IAC WILL LINEMODE).
3. Craft malicious SLC suboption: Construct a Telnet subnegotiation packet for LINEMODE SLC containing 40–50 SLC triplets, each consisting of 3 bytes: (func_code, flag, value), where func_code > 18 (beyond the expected range). Frame the payload as: IAC SB LINEMODE LM_SLC <triplets> IAC SE.
4. Send the payload: Transmit the crafted packet to the telnetd service. The add_slc function will write the excess triplets beyond the buffer boundary, triggering the out-of-bounds write.
5. Achieve code execution (advanced): With a full exploit (ROP chain or shellcode targeting the specific binary/OS), an attacker could redirect execution to attacker-controlled code running as the telnetd process (typically root). The public PoC confirms the overflow but does not include a working ROP chain (GNU bug list, PoC GitHub, watchTowr Labs).

• Network: Unexpected or anomalous TCP connections to port 23 from external or untrusted IP addresses; Telnet sessions sending unusually large LINEMODE SLC subnegotiation packets (IAC SB LINEMODE sequences with 40+ SLC triplets); scanning activity against port 23 from known threat infrastructure.
• Logs: System logs (/var/log/syslog, /var/log/auth.log) showing telnetd process crashes or restarts; kernel logs (dmesg) indicating segmentation faults or memory corruption in the telnetd process; unusual authentication attempts or sessions on port 23.
• Process: Unexpected child processes spawned by telnetd (e.g., /bin/sh, bash, curl, wget); telnetd process running with elevated privileges spawning network tools or reverse shells.
• File System: New or modified files in /tmp, /var/tmp, or world-writable directories created by the telnetd process; unexpected cron jobs, SSH authorized keys, or backdoor scripts added post-exploitation.
• Detection Tools: Nessus plugins 302234, 303005, 303143, 304942, 307667, 320402 and Qualys detections 761716, 6275070 flag vulnerable GNU inetutils installations (watchTowr GitHub).

The primary remediation is to upgrade GNU inetutils to a version newer than 2.7 that includes the patch, which was referenced in the GNU inetutils bug archive as of May 5, 2026 (GNU bug list). Downstream distributions including Debian (DSA-6193-1, DLA-4527-1), openSUSE, SUSE, Ubuntu (USN-8387-1), and Mageia (MGASA-2026-0122) have released updated packages. Synology issued advisory SA_26_03 for affected DiskStation Manager products. If immediate patching is not possible: (1) disable the telnetd service entirely (systemctl disable telnet.socket), (2) restrict access to port 23 using firewall rules to trusted hosts only, and (3) migrate to SSH as a secure alternative. Organizations should prioritize patching given the availability of public PoC code and the critical CVSS score.

The vulnerability received significant media and community attention upon disclosure. The Hacker News, Security Affairs, CSO Online, GBHackers, CyberSecurityNews, and Heise (German/English) all published coverage describing it as a critical pre-authentication RCE flaw. watchTowr Labs published a detailed technical blog post titled "A 32-Year-Old Bug Walks Into a Telnet Server" (watchTowr Labs), which generated substantial discussion on Reddit (r/netsec, r/cybersecurity), Mastodon, and Bluesky. Dream Security, the original discoverers, also published a detailed advisory and later presented related research at Black Hat Asia. The vulnerability was widely characterized as a "ghost from the 1990s" given that telnetd code dates back decades. Emerging Threats released detection rules (ruleset update 2026-03-25), and GreyNoise began tracking scanning activity in May 2026 (Security Affairs).