CVE-2026-109243: FreeRDP 3.0.0 before 3.32.0 Insecure Permissions on Soft-Smartcard Private Key File

Q: Which systems are realistically exposed?

Multi-user Unix hosts are exposed when FreeRDP soft-smartcard logon writes a PKINIT private-key copy to a shared temporary directory. A local user who can access that host may be able to enumerate the directory and read the key file.

Q: What does an attacker need to exploit this issue?

The attacker needs local access to the affected Unix host and must be able to observe or enumerate the shared temporary directory during a soft-smartcard logon. The CVSS vector also indicates high attack complexity, low privileges, and user interaction are required.

Q: How can I determine whether an installation is affected?

Installations running FreeRDP from 3.0.0 before 3.32.0 are affected. Exposure additionally depends on use of soft-smartcard logon that causes crypto_write_pem to write the PKINIT private-key copy in a shared temporary directory.

Q: What can be done if updating is not immediately possible?

Avoid soft-smartcard logons on shared multi-user Unix systems where local users can enumerate the temporary directory. Limiting untrusted local access reduces the opportunity to read the world-readable private-key copy.

Published Oct 12, 2026

Updated

FreeRDP from 3.0.0 before 3.32.0 contains an incorrect permission assignment vulnerability that allows local users to read private keys written by cryptowritepem without owner-only permissions. Attackers on multi-user Unix hosts can enumerate the shared temporary directory during soft-smartcard logon to read the world-readable PKINIT private-key copy.

Affected Software

1 affected component

FreeRDP freerdp>=3.0.0<3.32.0

Event History

Oct 12, 2026

CVE Published

via MITRE·04:04 PM

Data Sourced

via MITRE·04:04 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·05:17 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Which systems are realistically exposed?

Multi-user Unix hosts are exposed when FreeRDP soft-smartcard logon writes a PKINIT private-key copy to a shared temporary directory. A local user who can access that host may be able to enumerate the directory and read the key file.

What does an attacker need to exploit this issue?

The attacker needs local access to the affected Unix host and must be able to observe or enumerate the shared temporary directory during a soft-smartcard logon. The CVSS vector also indicates high attack complexity, low privileges, and user interaction are required.

How can I determine whether an installation is affected?

Installations running FreeRDP from 3.0.0 before 3.32.0 are affected. Exposure additionally depends on use of soft-smartcard logon that causes crypto_write_pem to write the PKINIT private-key copy in a shared temporary directory.

What can be done if updating is not immediately possible?

Avoid soft-smartcard logons on shared multi-user Unix systems where local users can enumerate the temporary directory. Limiting untrusted local access reduces the opportunity to read the world-readable private-key copy.

CVE-2026-109243: FreeRDP 3.0.0 before 3.32.0 Insecure Permissions on Soft-Smartcard Private Key File

Affected Software

Event History

Frequently Asked Questions

Which systems are realistically exposed?

What does an attacker need to exploit this issue?

How can I determine whether an installation is affected?

What can be done if updating is not immediately possible?

Company

Resources

Contact

Frequently Asked Questions

Which systems are realistically exposed?

What does an attacker need to exploit this issue?

How can I determine whether an installation is affected?

What can be done if updating is not immediately possible?