CVE-2026-109243 — FreeRDP 3.0.0 before 3.32.0 Insecure Permissions on Soft-Smartcard Private Key File
FreeRDP from 3.0.0 before 3.32.0 contains an incorrect permission assignment vulnerability that allows local users to read private keys written by crypto_write_pem without owner…
Published: 2026-10-12 · CVSS: 4.1 · CVSS 4.0
FreeRDP from 3.0.0 before 3.32.0 contains an incorrect permission assignment vulnerability that allows local users to read private keys written by crypto_write_pem without owner-only permissions. Attackers on multi-user Unix hosts can enumerate the shared temporary directory during soft-smartcard logon to read the world-readable PKINIT private-key copy.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7