CVE-2026-72745 is a heap buffer overflow in FreeRDP's WinPR library during GSS Wrap token decryption. The vulnerability stems from unvalidated parsing of the EC (extra count) field in Kerberos GSS-API tokens. When processing a GSS Wrap token, the code correctly validates the RRC (recipient token offset) and total length fields, but treats EC as administrative metadata rather than a pointer arithmetic operand. EC is a 16-bit field that can carry values up to 65535, yet the token context is only ~60 bytes. This mismatch allows an attacker to specify an EC value far exceeding the token bounds, triggering an out-of-bounds read during AES-CTS-HMAC-SHA1 decryption before HMAC verification runs.
The in-place decryption design amplifies the impact: because decryption occurs before integrity checking, the out-of-bounds write proceeds unconstrained by cryptographic safeguards. HMAC validation happens after memory corruption has already occurred, making this a memory safety vulnerability with a cryptographic exploit surface.
WinPR serves as FreeRDP's portability layer, meaning this vulnerability exists in a library designed for reuse across multiple projects. The CVSS 7.5 score understates the exposure geometry because downstream consumers calling into WinPR's Kerberos path inherit this vulnerability without necessarily monitoring FreeRDP security advisories. If your project links against WinPR, you are exposed regardless of whether your own code touches Kerberos directly.
The vulnerability has lineage: CVE-2007-5441 in MIT krb5 addressed an identical pattern — unvalidated EC causing OOB read during GSS token decryption. The reference implementations patched this class over fifteen years ago. FreeRDP's kerberos.c either reimplemented this logic without consulting that history or imported unpatched code. This is not a novel vulnerability class; it's a known genotype expressing itself in a new implementation context.
Check whether your project depends on WinPR or any FreeRDP component. If it does, prioritize updating to 3.30.0 or later. Monitor your dependency trees for transitive WinPR exposure — the notification chain for portability library vulnerabilities is weaker than for direct dependencies. The patch adds bounds validation to the EC field; verify your deployed versions include it.