Withdrawn: this CVE is not a vulnerability
The assigning CNA withdrew CVE-2026-72745 on 12 August 2026, and it carries the Rejected state at CVE.org and NVD. It must not be treated as a live finding. Its pre-withdrawal severity, score and exploitability are withheld below; the record itself is kept because withdrawals are reversible and because the reject reason is the correction worth publishing.
CVE-2026-72745
FreeRDP before 3.30.0 Out-of-Bounds Read via Kerberos GSS Wrap-token EC
Description
Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority as it's a duplicate of CVE-2026-73242.
INFO
Published Date :
Aug. 11, 2026, 1:19 p.m.
Last Modified :
Aug. 12, 2026, 5:17 p.m.
Remotely Exploit :
—
Source :
[email protected]
CVSS Scores
| Score | Version | Severity | Vector | Exploitability Score | Impact Score | Source |
|---|---|---|---|---|---|---|
| CVSS 3.1 | HIGH | 83251b91-4cc7-4094-a5c7-464a1b83ea10 | ||||
| CVSS 3.1 | HIGH | [email protected] | ||||
| CVSS 3.1 | HIGH | MITRE-CVE | ||||
| CVSS 4.0 | HIGH | 83251b91-4cc7-4094-a5c7-464a1b83ea10 | ||||
| CVSS 4.0 | HIGH | [email protected] |
We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).
Results are limited to the first 15 repositories due to potential performance issues.
The following list is the news that have been mention
CVE-2026-72745 vulnerability anywhere in the article.
The following table lists the changes that have been made to the
CVE-2026-72745 vulnerability over time.
Vulnerability history details can be useful for understanding the evolution of a vulnerability, and for identifying the most recent changes that may impact the vulnerability's severity, exploitability, or other characteristics.
-
CVE Rejected by [email protected]
Aug. 12, 2026
Action Type Old Value New Value -
CVE Modified by [email protected]
Aug. 12, 2026
Action Type Old Value New Value Changed Description FreeRDP before 3.30.0 contains an out-of-bounds vulnerability in kerberos_DecryptMessage() (winpr/libwinpr/sspi/Kerberos/kerberos.c). The 16-bit EC (extra count) field of a peer-supplied GSS Wrap token (RFC 4121) is used directly in pointer arithmetic to locate the encrypted regions without being bounds-checked, while only RRC and the total buffer length are validated. A malicious peer (server or client) can supply a large EC value (up to 0xFFFF) during CredSSP/NLA authentication, moving the decrypt operation's base pointers past the end of the ~60-byte token buffer. Because the AES-CTS-HMAC enctypes decrypt in place before the HMAC integrity check, this results in an out-of-bounds read and in-place out-of-bounds write, potentially leading to information disclosure, memory corruption, or denial of service. Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority as it's a duplicate of CVE-2026-73242. Removed CVSS V4.0 VulnCheck: AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Removed CVSS V3.1 VulnCheck: AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N Removed CWE VulnCheck: CWE-122 Removed Reference VulnCheck: https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-vv64-95pc-vj9v Removed Reference VulnCheck: https://www.vulncheck.com/advisories/freerdp-before-out-of-bounds-read-via-kerberos-gss-wrap-token-ec Removed Affected [{'vendor': 'FreeRDP', 'product': 'FreeRDP', 'versions': [{'status': 'affected', 'version': '0', 'lessThan': '3.30.0', 'versionType': 'semver'}, {'status': 'unaffected', 'version': '3.30.0', 'versionType': 'semver'}], 'defaultStatus': 'unaffected'}] -
New CVE Received by [email protected]
Aug. 11, 2026
Action Type Old Value New Value Added Affected [{'vendor': 'FreeRDP', 'product': 'FreeRDP', 'versions': [{'status': 'affected', 'version': '0', 'lessThan': '3.30.0', 'versionType': 'semver'}, {'status': 'unaffected', 'version': '3.30.0', 'versionType': 'semver'}], 'defaultStatus': 'unaffected'}] Added Description FreeRDP before 3.30.0 contains an out-of-bounds vulnerability in kerberos_DecryptMessage() (winpr/libwinpr/sspi/Kerberos/kerberos.c). The 16-bit EC (extra count) field of a peer-supplied GSS Wrap token (RFC 4121) is used directly in pointer arithmetic to locate the encrypted regions without being bounds-checked, while only RRC and the total buffer length are validated. A malicious peer (server or client) can supply a large EC value (up to 0xFFFF) during CredSSP/NLA authentication, moving the decrypt operation's base pointers past the end of the ~60-byte token buffer. Because the AES-CTS-HMAC enctypes decrypt in place before the HMAC integrity check, this results in an out-of-bounds read and in-place out-of-bounds write, potentially leading to information disclosure, memory corruption, or denial of service. Added CVSS V4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Added CVSS V3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N Added CWE CWE-122 Added Reference https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-vv64-95pc-vj9v Added Reference https://www.vulncheck.com/advisories/freerdp-before-out-of-bounds-read-via-kerberos-gss-wrap-token-ec