CVE-2026-32746

Telnet is an old-fashioned way of remotely logging into a computer, like an unlocked back door that many businesses no longer use. This flaw lets an attacker send a specially crafted message to that door that overflows a memory buffer, potentially letting them crash the service or seize control of the machine — without needing a password.

This matters to you if any of your systems run the telnet server component of GNU inetutils (version 2.7 or earlier), which is included in some Linux distributions such as Astra Linux. It's only a real risk if the telnet service is actually running and reachable — either from the internet or from within your internal network.

No confirmed real-world attacks have been reported yet, and no public exploit code is known to exist, but researchers rate the chance of exploitation as high and rising, and press interest is increasing following the patch announcement. Treat this as a priority to address soon, even though it is not (yet) an active, confirmed attack.

Confirm exposure by checking for the telnetd binary from GNU inetutils ≤2.7 on all hosts, including Astra Linux systems, and verify whether port 23 is exposed internally or externally. The vendor has published a fix thread (see lists.gnu.org/archive/html/bug-inetutils/2026-03/msg00031.html) — track your distribution's advisory for the backported fixed package version and apply it via your usual package manager update process once released. As a compensating control (per vendor guidance), restrict or disable use of the telnet protocol for remote access to the affected software, and firewall port 23 from untrusted networks in the meantime. There is no CISA KEV listing and no confirmed exploitation yet, so this is not an emergency drop-everything item, but given the 9.8 CVSS score, unauthenticated vector, and rising EPSS trend, prioritize patching within your normal critical-vulnerability SLA. Monitor the GNU inetutils mailing list and your distro's security advisories for the official fixed release, and watch for any KEV listing or confirmed exploitation reports that would escalate urgency.

CVSS 9.8 (Critical), AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H — network-reachable, no privileges or user interaction required, full compromise of confidentiality, integrity and availability. Weakness: CWE-120 (buffer copy without checking size of input), specifically an out-of-bounds write in add_slc() during LINEMODE SLC suboption negotiation in telnetd. Not in CISA KEV, no public exploit code identified, but EPSS is 44.1% (99th percentile) with a rising trend, indicating elevated predicted likelihood of exploitation despite the absence of current confirmed attacks. Exploit maturity is currently theoretical/PoC-absent; press and vendor attention is rising due to the recent patch disclosure.