FreeRDP from 3.0.0 before 3.32.0 contains an incorrect permission assignment vulnerability that allows local users to read private keys written by… (CVE-2026-109243)

FreeRDP versions starting from 3.0.0 and before 3.32.0 contain an incorrect permission assignment vulnerability (CWE-732) that permits local users to read private keys generated by the crypto_write_pem function. The vulnerability arises because these private keys are written with permissions that are not restricted to the owner, making them world-readable. On multi-user Unix hosts, attackers can enumerate the shared temporary directory during soft-smartcard logon and access the PKINIT private-key copy, which should remain confidential.

Local attackers with low privileges on multi-user Unix systems can read private cryptographic keys that are intended to be private. This exposure can lead to compromise of cryptographic operations relying on those keys, potentially undermining authentication or encryption mechanisms that depend on them. The vulnerability does not allow modification or denial of service but compromises confidentiality.

A fix is available in FreeRDP version 3.32.0 and later. Users should upgrade to version 3.32.0 or newer to resolve the incorrect permission assignment vulnerability. Until upgrading, restrict local user access to the shared temporary directory or avoid using soft-smartcard logon on multi-user Unix systems if possible. Patch status is confirmed by the version range affected and fixed in 3.32.0.