A 32-year-old pre-authentication remote code execution vulnerability, CVE-2026-32746, has been discovered in GNU inetutils Telnetd by the DREAM Security Research Team. Originating in 1994 — the same year the movie Hackers was released — the BSS-based buffer overflow resides in the LINEMODE SLC negotiation handler, allowing attackers to corrupt roughly 400 bytes of adjacent variables. While the patch targets inetutils-telnetd, the vulnerability's blast radius is vast because most vendors base their Telnetd implementations on the same code.

Affected systems include Ubuntu, Debian, FreeBSD, NetBSD, Citrix NetScaler, Apple, TrueNAS, DragonFly BSD, and others. Despite Telnet's insecurity and plaintext transmission, it remains prevalent in production environments, often due to legacy hardware constraints like 8-bit microcontrollers in industrial equipment. Exploitation is complex, described as a "Pandora's box," and nearly a week after disclosure, no public exploit analysis has emerged.

The vulnerability highlights the enduring risk of ancient code in modern infrastructure.