Bugzilla – Bug 1259691
VUL-0: CVE-2026-32746: krb5-appl: Remote Pre-Auth Buffer Overflow in GNU Inetutils telnetd LINEMODE
Last modified: 2026-03-19 12:30:01 UTC
telnetd in GNU inetutils through 2.7 allows an out-of-bounds write in the LINEMODE SLC (Set Local Characters) suboption handler because add_slc does not check whether the buffer is full. References: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2026-32746 https://www.cve.org/CVERecord?id=CVE-2026-32746 https://lists.gnu.org/archive/html/bug-inetutils/2026-03/msg00031.html http://www.openwall.com/lists/oss-security/2026/03/12/4 https://seclists.org/oss-sec/2026/q1/311 https://github.com/CVEProject/cvelistV5/blob/main//cves/2026/32xxx/CVE-2026-32746.json
Affected packages: - openSUSE:Backports:SLE-15-SP7:Update/krb5-appl - openSUSE:Backports:SLE-16.0/krb5-appl - openSUSE:Factory/krb5-appl - SUSE:SLE-12:Update/krb5-appl Upstream patch: https://codeberg.org/inetutils/inetutils/pulls/17/files
This is an autogenerated message for OBS integration: This bug (1259691) was mentioned in https://src.opensuse.org/pool/krb5-appl/pulls/1 leap-16.0 / krb5-appl
devel project https://build.opensuse.org/requests/1339545 leap160 https://src.opensuse.org/pool/krb5-appl/pulls/1 15sp7 backports https://build.opensuse.org/request/show/1339504 12 https://build.suse.de/request/show/403730
I believe all fixed.
(In reply to Petr Gajdos from comment #4) > 15sp7 backports > https://build.opensuse.org/request/show/1339504 Superseeded by https://build.opensuse.org/request/show/1339562
openSUSE-SU-2026:0088-1: An update that fixes one vulnerability is now available. Category: security (critical) Bug References: 1259691 CVE References: CVE-2026-32746 JIRA References: Sources used: openSUSE Backports SLE-15-SP7 (src): krb5-appl-1.0.3-bp157.2.3.1
SUSE-SU-2026:0930-1: An update that solves one vulnerability can now be installed. URL: https://www.suse.com/support/update/announcement/2026/suse-su-20260930-1 Category: security (critical) Bug References: 1259691 CVE References: CVE-2026-32746 Maintenance Incident: [SUSE:Maintenance:43205](https://smelt.suse.de/incident/43205/) Sources used: SUSE Linux Enterprise Server 12 SP5 LTSS (src): krb5-appl-1.0.3-3.12.1 SUSE Linux Enterprise Server 12 SP5 LTSS Extended Security (src): krb5-appl-1.0.3-3.12.1 NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.