CVE-2026-109244: FreeRDP 2.0.0 before 3.32.0 Insecure Private Key Permissions in winpr-makecert
FreeRDP from 2.0.0 before 3.32.0 contains an insecure permission vulnerability in winpr-makecert that creates unencrypted private keys without owner-only file modes. Local users on multi-user Unix hosts can read world-readable key files or open PFX files protected by the hard-coded default password to steal private keys.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/freerdp3to a version that resolves this vulnerability.Fixed in 3.32.0+dfsg-1 - Upgrade
Upgrade
debian/freerdp3to a version that resolves this vulnerability.Fixed in 3.32.2+dfsg-1Fixed in 3.33.0+dfsg-1
Event History
Frequently Asked Questions
Who is most exposed to private-key disclosure?
Multi-user Unix hosts where winpr-makecert has generated certificate keys are exposed to local users who can read world-readable key files. PFX files created by the tool may also expose their private keys because they use a hard-coded default password.
What access does an attacker need?
An attacker needs local access to the affected Unix host and the ability to read the generated key material or obtain the generated PFX file. User interaction is also listed as required in the supplied severity vector.
How can I determine whether generated keys may be affected?
Review private keys and PFX files generated by winpr-makecert on FreeRDP versions from 2.0.0 before 3.32.0. Check whether private-key files are readable by users other than the owner and whether PFX files rely on the tool's hard-coded default password.
What can be done if upgrading is not immediately possible?
Restrict access to affected key files so only their owner can read them, and treat any potentially exposed private keys as compromised. Replace exposed keys and avoid relying on PFX files protected by the hard-coded default password.