CVE-2026-109243
Received Received - Intake

Incorrect Permission Assignment in FreeRDP Allows Local Key Exposure

Publication date: 2026-10-12

Last updated on: 2026-10-12

Assigner: VulnCheck

Description
FreeRDP from 3.0.0 before 3.32.0 contains an incorrect permission assignment vulnerability that allows local users to read private keys written by crypto_write_pem without owner-only permissions. Attackers on multi-user Unix hosts can enumerate the shared temporary directory during soft-smartcard logon to read the world-readable PKINIT private-key copy.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-12
Last Modified
2026-10-12
Generated
2026-10-12
AI Q&A
2026-10-12
EPSS Evaluated
N/A
NVD
CVE-2026-109243
EUVD
EUVD-2026-97687

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
FreeRDP FreeRDP 3.0.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-732 The product specifies permissions for a security-critical resource in a way that allows that resource to be read or modified by unintended actors.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-109243 is an incorrect permission assignment vulnerability in FreeRDP versions 3.0.0 through 3.31.1. When soft-smartcard logon is enabled with a PEM certificate and private key on a multi-user Unix host, the private key is copied to a shared temporary directory with overly permissive file permissions (mode 0644). This allows unprivileged local users to read the private key during its brief existence before deletion.

Detection Guidance

Check FreeRDP versions 3.0.0 to 3.31.1 for the vulnerability. Monitor shared temporary directories like /tmp for world-readable PKINIT private-key files during soft-smartcard logon. Use commands like 'ls -l /tmp' to inspect file permissions or 'find /tmp -type f -perm 0644 -name "*.pem"' to locate potentially exposed private keys.

Impact Analysis

The vulnerability allows local attackers on multi-user Unix systems to read private keys used for PKINIT authentication. This could lead to unauthorized access to systems or services relying on those keys. The exposure is limited to local users and requires specific conditions like a shared temporary directory and permissive umask.

Mitigation Strategies

Upgrade FreeRDP to version 3.32.0 or later. Set umask to 077 to restrict file permissions. Use a private per-user runtime directory for temporary files. Avoid enabling soft-smartcard logon on multi-user Unix systems until patched.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-109243. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart