Critical Unpatched Telnetd Flaw (CVE-2026-32746) Enables Unauthenticated Root RCE via Port 23

A critical unauthenticated remote code execution vulnerability (CVE-2026-32746, CVSS 9.8) has been disclosed in GNU InetUtils telnetd, affecting all versions through 2.7.

• •The flaw is an out-of-bounds write in the LINEMODE SLC suboption handler, triggered via a crafted protocol message during the initial connection handshake before authentication
• •A single connection to port 23 is sufficient to exploit it — no credentials, user interaction, or special network position required
• •Since telnetd typically runs as root under inetd/xinetd, successful exploitation grants full system control
• •Post-exploitation risks include persistent backdoor deployment, data exfiltration, and lateral movement using compromised hosts as pivot points
• •