FreeRDP from 2.0.0 before 3.32.0 contains an insecure permission vulnerability in winpr-makecert that creates unencrypted private keys without… (CVE-2026-109244)

The vulnerability in FreeRDP's winpr-makecert component affects versions starting from 2.0.0 before 3.32.0. It improperly sets file permissions on generated private keys, making them world-readable instead of owner-only. Additionally, PFX files are protected by a hard-coded default password, which local users can exploit to access private keys. This insecure permission setting can lead to unauthorized disclosure of sensitive cryptographic material on multi-user Unix hosts.

Local users on multi-user Unix systems can read private keys that should be protected, potentially compromising the confidentiality and integrity of cryptographic operations relying on these keys. This could lead to unauthorized access or impersonation if the keys are used for authentication or encryption.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to systems running affected versions to trusted users only and consider regenerating keys with secure permissions using alternative tools or manual permission adjustments.