CVE-2026-72745

✕ Withdrawn — historical dataHIGHPre-NVD 7.5
7.5CVSS

FreeRDP before 3.30.0 contains an out-of-bounds vulnerability in kerberos_DecryptMessage() (winpr/libwinpr/sspi/Kerberos/kerberos.c). The 16-bit EC (extra count) field of a peer-supplied GSS Wrap token (RFC 4121) is used directly in pointer arithmetic to locate the encrypted regions without being bounds-checked, while only RRC and the total buffer length are validated. A malicious peer (server or client) can supply a large EC value (up to 0xFFFF) during CredSSP/NLA authentication, moving the decrypt operation's base pointers past the end of the ~60-byte token buffer. Because the AES-CTS-HMAC enctypes decrypt in place before the HMAC integrity check, this results in an out-of-bounds read and in-place out-of-bounds write, potentially leading to information disclosure, memory corruption, or denial of service.

CVSS v3
7.5
EchelonGraph score
Not yet assessedThis CVE record was withdrawn by its numbering authority, so there is no vulnerability to rate.
EPSS PROB
—
EPSS %ILE
—
KEV
—Not applicable: this CVE ID was withdrawn

Published

August 11, 2026

Last Modified

August 11, 2026

References (2)

Frequently asked(4)

What is CVE-2026-72745?
CVE-2026-72745 is a rejected CVE ID: its record was withdrawn on August 12, 2026 and no longer describes a vulnerability. Reason given: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority as it's a duplicate of CVE-2026-73242. Its record names CVE-2026-73242 as the replacement.
When was the CVE record for CVE-2026-72745 published?
The CVE record for CVE-2026-72745 was published on August 11, 2026. EchelonGraph's copy of the record carries a last-modified date of August 11, 2026; the record at its source may have been updated since.
What is the CVSS score of CVE-2026-72745?
CVE-2026-72745 has a CVSS base score of 7.5 (a secondary CVSS source that NVD displays; NVD's own analysis pending).
How do I remediate CVE-2026-72745?
There is nothing to remediate under CVE-2026-72745: it is a rejected (withdrawn) CVE ID and no longer describes a vulnerability. Its record names CVE-2026-73242 as the replacement; act on that CVE instead.