What is the CVSS score of EUVD-2026-12065?

EUVD-2026-12065 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Inetutils are affected by EUVD-2026-12065?

CVE-2026-32746 is a critical, unauthenticated remote code execution vulnerability affecting GNU inetutils telnetd that could allow attackers to completely compromise affected systems.. A patch is available.

Is there a public PoC exploit available for EUVD-2026-12065?

Yes, a public proof-of-concept exploit is available for EUVD-2026-12065. Prioritise patching immediately. EPSS: 0.0%.

How to fix or mitigate EUVD-2026-12065?

Within 24 hours: Inventory all systems running GNU inetutils telnetd and assess internet exposure; disable telnetd service if not operationally critical and document justification if retention is required. Within 7 days: Implement network segmentation to restrict telnetd access to authorized administrative networks only; deploy monitoring for telnet service activity and connection attempts. Within 30 days: Develop and test migration plan to SSH or other secure protocols; establish process to apply patch immediately upon vendor release; conduct security assessment of any telnetd-dependent legacy systems to identify replacement timeline.

Inetutils EUVD-2026-12065

| CVE-2026-32746 CRITICAL

Classic Buffer Overflow (CWE-120)

2026-03-13 mitre

Buffer Overflow Inetutils Gnu

9.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

SUSE

CRITICAL

qualitative

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

EUVD ID Assigned

Mar 13, 2026 - 18:00 euvd

EUVD-2026-12065

Analysis Generated

Mar 13, 2026 - 18:00 vuln.today

CVE Published

Mar 13, 2026 - 17:15 nvd

CRITICAL 9.8

DescriptionCVE.org

telnetd in GNU inetutils through 2.7 allows an out-of-bounds write in the LINEMODE SLC (Set Local Characters) suboption handler because add_slc does not check whether the buffer is full.

Articles & Coverage 1

labs.watchtowr.com A 32-Year-Old Bug Walks Into A Telnet Server (GNU inetutils Telnetd CVE-2026-32746 Pre-Auth RCE)

AnalysisAI

OOB write in GNU inetutils telnetd through 2.7 via LINEMODE SLC handler.

Technical ContextAI

CWE-120 in add_slc function.

RemediationAI

Update inetutils.

More in Inetutils

View all

CVE-2026-24061 CRITICAL Act Now POC

9.8 Jan 21

GNU Inetutils telnetd through version 2.7 contains a critical authentication bypass that allows remote attackers to gain

CVE-2023-40303 HIGH This Week POC

7.8 Aug 14

GNU inetutils before 2.5 may allow privilege escalation because of unchecked return values of set*id() family functions

CVE-2022-39028 HIGH This Week POC

7.5 Aug 30

telnetd in GNU Inetutils through 2.3, MIT krb5-appl through 1.0.3, and derivative works has a NULL pointer dereference v

CVE-2026-28372 HIGH This Week POC

7.4 Feb 27

Inetutils versions up to 2.7 is affected by inclusion of functionality from untrusted control sphere (CVSS 7.4).

CVE-2021-40491 MEDIUM This Month

6.5 Sep 03

The ftp client in GNU Inetutils before 2.2 does not validate addresses returned by PASV/LSPV responses to make sure they

CVE-2026-32772 LOW Monitor

3.4 Mar 13

telnet in GNU inetutils through 2.7 allows servers to read arbitrary environment variables from clients via NEW_ENVIRON

Same weakness CWE-120 – Classic Buffer Overflow

View all

CVE-2017-7269 CRITICAL POC

9.8

CVE-2019-11043 CRITICAL POC

9.8

CVE-2016-10174 CRITICAL POC

9.8

CVE-2016-0099 HIGH POC

7.8

CVE-2016-6366 HIGH POC

8.8

CVE-2013-1331 HIGH

7.8

CVE-2013-0641 HIGH

7.8

CVE-2017-15222 CRITICAL POC

9.8

Same technique Buffer Overflow

View all

CVE-2017-7269 CRITICAL POC

9.8

CVE-2015-5119 CRITICAL POC

9.8

CVE-2015-3113 CRITICAL POC

9.8

CVE-2011-2462 CRITICAL POC

9.8

CVE-2020-0796 CRITICAL POC

10.0

CVE-2019-11043 CRITICAL POC

9.8

CVE-2009-0927 HIGH POC

8.8

CVE-2012-1889 HIGH POC

8.8

Vendor StatusVendor

SUSE

Severity: Critical

Product	Status
SUSE Linux Enterprise Server 12 SP5-LTSS	Fixed
SUSE Linux Enterprise Server LTSS Extended Security 12 SP5	Fixed
openSUSE Leap 16.0	Fixed
SUSE Linux Enterprise Server 12 SP5	Fixed
SUSE Linux Enterprise Server 12 SP5-LTSS	Fixed

EUVD-2026-12065 vulnerability details – vuln.today

Back

Inetutils EUVD-2026-12065

Severity by source

CVSS VectorNVD

Lifecycle Timeline

DescriptionCVE.org

Articles & Coverage 1

AnalysisAI

Technical ContextAI

RemediationAI

More in Inetutils

Same weakness CWE-120 – Classic Buffer Overflow

Same technique Buffer Overflow

Vendor StatusVendor

SUSE

Share

External POC / Exploit Code