EIP-2026-102696

This exploit triggers an out-of-bounds array write in GNU Netcat 0.7.1 by sending a Telnet control character followed by repeated bytes, causing a crash. The vulnerability lies in the Telnet negotiation code where array bounds are not properly checked.