CVE-2026-109244

MEDIUMCVSS 6.6

Description

FreeRDP from 2.0.0 before 3.32.0 contains an insecure permission vulnerability in winpr-makecert that creates unencrypted private keys without owner-only file modes. Local users on multi-user Unix hosts can read world-readable key files or open PFX files protected by the hard-coded default password to steal private keys.

Timeline

Published:October 12th, 2026 5:17 PM

Last modified:November 2nd, 2026 8:46 PM

CVSS Scoring

CVSS v3: 6.6 (MEDIUM)

CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N

Affected Software

From NVD CPE configuration data

Vendors

freerdp

Products

freerdp

Weaknesses (CWE)

CWE-732

References & Reports

Advisories, patches, and third-party reports

https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-2jfv-j3wx-5cg4Exploit
https://www.vulncheck.com/advisories/freerdp-2.0.0-before-3.32.0-insecure-private-key-permissions-in-winpr-makecertThird Party Advisory

Source: NIST NVD · Data may lag official sources by up to one minute