CVE-2026-109243: FreeRDP 3.0.0 before 3.32.0 Insecure Permissions on Soft-Smartcard Private Key File
FreeRDP from 3.0.0 before 3.32.0 contains an incorrect permission assignment vulnerability that allows local users to read private keys written by cryptowritepem without owner-only permissions. Attackers on multi-user Unix hosts can enumerate the shared temporary directory during soft-smartcard logon to read the world-readable PKINIT private-key copy.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/freerdp3to a version that resolves this vulnerability.Fixed in 3.32.0+dfsg-1 - Upgrade
Upgrade
debian/freerdp3to a version that resolves this vulnerability.Fixed in 3.32.2+dfsg-1Fixed in 3.33.0+dfsg-1
Event History
Frequently Asked Questions
Which systems are realistically exposed?
Multi-user Unix hosts are exposed when FreeRDP soft-smartcard logon writes a PKINIT private-key copy to a shared temporary directory. A local user who can access that host may be able to enumerate the directory and read the key file.
What does an attacker need to exploit this issue?
The attacker needs local access to the affected Unix host and must be able to observe or enumerate the shared temporary directory during a soft-smartcard logon. The CVSS vector also indicates high attack complexity, low privileges, and user interaction are required.
How can I determine whether an installation is affected?
Installations running FreeRDP from 3.0.0 before 3.32.0 are affected. Exposure additionally depends on use of soft-smartcard logon that causes crypto_write_pem to write the PKINIT private-key copy in a shared temporary directory.
What can be done if updating is not immediately possible?
Avoid soft-smartcard logons on shared multi-user Unix systems where local users can enumerate the temporary directory. Limiting untrusted local access reduces the opportunity to read the world-readable private-key copy.