telnetd in GNU inetutils through 2.7 allows an out-of-bounds write in the LINEMODE SLC (Set Local Characters) suboption handler because add_slc does not check whether the buffer is full.
"https://storage.googleapis.com/cve-osv-conversion/alpine/ALPINE-CVE-2026-32746.json"