Fix CVE-2026-32746

--00000000000034747d064df7ebb0
Content-Type: multipart/alternative; boundary="00000000000034747c064df7ebae"

--00000000000034747c064df7ebae
Content-Type: text/plain; charset="UTF-8"

Dear GNU InetUtils maintainers,

I am submitting a patch to address the critical vulnerability identified as
CVE-2026-32746 in telnetd.

The vulnerability is a buffer overflow in the add_slc function within the
LINEMODE SLC suboption handling. An unauthenticated remote attacker can
exploit this to achieve arbitrary code execution.

This patch introduces proper bounds checking before writing to the
destination buffer, preventing the overflow. I have tested this against the
current 2.7 release and confirmed it remediates the issue without breaking
existing telnet functionality.

Please find the .patch file attached. I am available to discuss any
necessary adjustments or to complete the FSF copyright assignment if
required.


Best regards,
benjamin leon dubos

--00000000000034747c064df7ebae
Content-Type: text/html; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

<div dir=3D"ltr">Dear GNU InetUtils maintainers,<div><br>I am submitting a =
patch to address the critical vulnerability identified as CVE-2026-32746 in=
 telnetd.</div><div><br>The vulnerability is a buffer overflow in the add_s=
lc function within the LINEMODE SLC suboption handling. An unauthenticated =
remote attacker can exploit this to achieve arbitrary code execution.</div>=
<div><br></div><div>This patch introduces proper bounds checking before wri=
ting to the destination buffer, preventing the overflow. I have tested this=
 against the current 2.7 release and confirmed it remediates the issue with=
out breaking existing telnet functionality.</div><div><br>Please find the .=
patch file attached. I am available to discuss any necessary adjustments or=
 to complete the FSF copyright assignment if required.</div><div><br></div>=
<div><br>Best regards,</div><div>benjamin leon dubos</div></div>

--00000000000034747c064df7ebae--

--00000000000034747d064df7ebb0
Content-Type: application/octet-stream; name="FIX-cve-2026-32746.patch"
Content-Disposition: attachment; filename="FIX-cve-2026-32746.patch"
Content-Transfer-Encoding: base64
Content-ID: <f_mn89bz2l0>
X-Attachment-Id: f_mn89bz2l0

LS0tIHRlbG5ldGQvc2xjLmMub3JpZwkyMDI2LTAzLTI2IDIyOjE4OjU1LjYzMzc1MjU4NCAtMDMw
MAorKysgdGVsbmV0ZC9zbGMuYwkyMDI2LTAzLTI2IDIyOjE3OjMzLjc3MTY0ODA5MiAtMDMwMApA
QCAtMTYyLDYgKzE2MiwxMSBAQAogdm9pZAogYWRkX3NsYyAoY2hhciBmdW5jLCBjaGFyIGZsYWcs
IGNjX3QgdmFsKQogeworICBpZiAoc2xjcHRyICsgNiA+PSBzbGNidWYgKyBzaXplb2YgKHNsY2J1
ZikpCisgICAgeworICAgICAgcmV0dXJuOworICAgIH0KKwogICBpZiAoKCpzbGNwdHIrKyA9ICh1
bnNpZ25lZCBjaGFyKSBmdW5jKSA9PSAweGZmKQogICAgICpzbGNwdHIrKyA9IDB4ZmY7CiAK
--00000000000034747d064df7ebb0--