telnetd in GNU inetutils up to version 2.7 contains an out-of-bounds write in the LINEMODE SLC (Set Local Characters) suboption handler because add_slc does not verify that the buffer is full. This flaw can allow a remote attacker to corrupt memory, potentially leading to arbitrary code execution on the host running telnetd.

The vulnerability affects the telnet daemon component of GNU inetutils, specifically versions up to and including 2.7. Any deployment that uses this version of inetutils and exposes the telnet service is impacted. Exact affected subcomponents are listed as the telnet daemon handler for the LINEMODE SLC suboption.

The flaw has a CVSS score of 9.8, indicating critical severity. The EPSS score is below 1%, suggesting it has not yet been widely exploited in the wild. It is not listed in CISA’s KEV catalog. The likely attack vector is a remote network client connecting to telnet over TCP, wherein the attacker sends crafted SLC commands to trigger the out-of-bounds write. No workaround is provided, so the risk remains until the software is updated.