Three vulnerabilities in GNU Inetutils up to version 2.7 include a critical (CVSS 9.8) buffer overflow in the telnet daemon's LINEMODE SLC suboption handling allowing denial of service or code execution, a high-severity (CVSS 7.4) privilege escalation via the daemon's CREDENTIALS_DIRECTORY environment variable, and a low-severity (CVSS 3.4) information leak in the telnet client's NEW_ENVIRON SEND USERVAR option allowing arbitrary environment variable reads.
It was discovered that the Inetutils telnet daemon incorrectly handled the CREDENTIALS_DIRECTORY environment variable. An attacker could possibly use this issue to escalate privileges. (CVE-2026-28372) It was discovered that the Inetutils telnet daemon did not properly validate buffer bounds when processing LINEMODE SLC suboptions. An attacker could possibly use this issue to cause a denial of service or execute arbitrary code. (CVE-2026-32746) It was discovered that the Inetutils telnet client incorrectly handled the NEW_ENVIRON SEND USERVAR option. An attacker could possibly use this issue to read arbitrary environment variables. (CVE-2026-32772)