CVE-2026-109244: FreeRDP 2.0.0 before 3.32.0 Insecure Private Key Permissions in winpr-makecert

Q: Who is most exposed to private-key disclosure?

Multi-user Unix hosts where winpr-makecert has generated certificate keys are exposed to local users who can read world-readable key files. PFX files created by the tool may also expose their private keys because they use a hard-coded default password.

Q: What access does an attacker need?

An attacker needs local access to the affected Unix host and the ability to read the generated key material or obtain the generated PFX file. User interaction is also listed as required in the supplied severity vector.

Q: How can I determine whether generated keys may be affected?

Review private keys and PFX files generated by winpr-makecert on FreeRDP versions from 2.0.0 before 3.32.0. Check whether private-key files are readable by users other than the owner and whether PFX files rely on the tool's hard-coded default password.

Q: What can be done if upgrading is not immediately possible?

Restrict access to affected key files so only their owner can read them, and treat any potentially exposed private keys as compromised. Replace exposed keys and avoid relying on PFX files protected by the hard-coded default password.

Published Oct 12, 2026

Updated

FreeRDP from 2.0.0 before 3.32.0 contains an insecure permission vulnerability in winpr-makecert that creates unencrypted private keys without owner-only file modes. Local users on multi-user Unix hosts can read world-readable key files or open PFX files protected by the hard-coded default password to steal private keys.

Affected Software

1 affected component

FreeRDP freerdp>=2.0.0<3.32.0

Event History

Oct 12, 2026

CVE Published

via MITRE·04:04 PM

Data Sourced

via MITRE·04:04 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·05:17 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Who is most exposed to private-key disclosure?

Multi-user Unix hosts where winpr-makecert has generated certificate keys are exposed to local users who can read world-readable key files. PFX files created by the tool may also expose their private keys because they use a hard-coded default password.

What access does an attacker need?

An attacker needs local access to the affected Unix host and the ability to read the generated key material or obtain the generated PFX file. User interaction is also listed as required in the supplied severity vector.

How can I determine whether generated keys may be affected?

Review private keys and PFX files generated by winpr-makecert on FreeRDP versions from 2.0.0 before 3.32.0. Check whether private-key files are readable by users other than the owner and whether PFX files rely on the tool's hard-coded default password.

What can be done if upgrading is not immediately possible?

Restrict access to affected key files so only their owner can read them, and treat any potentially exposed private keys as compromised. Replace exposed keys and avoid relying on PFX files protected by the hard-coded default password.

CVE-2026-109244: FreeRDP 2.0.0 before 3.32.0 Insecure Private Key Permissions in winpr-makecert

Affected Software

Event History

Frequently Asked Questions

Who is most exposed to private-key disclosure?

What access does an attacker need?

How can I determine whether generated keys may be affected?

What can be done if upgrading is not immediately possible?

Company

Resources

Contact

Frequently Asked Questions

Who is most exposed to private-key disclosure?

What access does an attacker need?

How can I determine whether generated keys may be affected?

What can be done if upgrading is not immediately possible?