CVE-2026-109243 in FreeRDP
Summary
by MITRE • 10/12/2026
FreeRDP from 3.0.0 before 3.32.0 contains an incorrect permission assignment vulnerability that allows local users to read private keys written by crypto_write_pem without owner-only permissions. Attackers on multi-user Unix hosts can enumerate the shared temporary directory during soft-smartcard logon to read the world-readable PKINIT private-key copy.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 10/12/2026
The identified vulnerability in FreeRDP versions ranging from 3.0.0 up to, but not including, version 3.32.0 represents a critical flaw in file system permission management during cryptographic operations. Specifically, the function crypto_write_pem is responsible for writing private keys to disk in Privacy-Enhanced Mail format. However, this implementation fails to enforce restrictive access controls on the resulting files. Instead of creating these temporary key files with owner-only permissions that restrict read and write access exclusively to the user initiating the authentication process, the system assigns world-readable permissions. This misconfiguration means that any local user account on a multi-user Unix or Linux host can potentially access sensitive cryptographic material generated by other users during their session activities.
The operational impact of this vulnerability is most pronounced in environments utilizing soft-smartcard logon mechanisms combined with PKINIT authentication protocols. During the login process, FreeRDP generates temporary private keys required for Kerberos Pre-Authentication using Public Key Cryptography Standard No. 9 (PKINIT). These keys are stored in shared temporary directories accessible to all users on the system. Because the files lack proper isolation through restrictive permissions, an attacker with local shell access can enumerate these directories and identify the newly created key files associated with active or recent authentication sessions of other privileged accounts. By reading these world-readable private keys, a malicious actor effectively compromises the confidentiality of the user's identity credentials without needing to exploit additional software vulnerabilities or gain elevated privileges through traditional privilege escalation techniques.
From a classification perspective, this issue aligns directly with CWE-732: Incorrect Permission Assignment for Critical Resource within the Common Weakness Enumeration framework. The root cause lies in the failure to apply the principle of least privilege when handling sensitive cryptographic material on disk. Furthermore, from an offensive security standpoint as mapped by MITRE ATT&CK, this vulnerability facilitates Credential Access techniques such as T1552.004: Unsecured Credentials (Private Keys). An adversary leveraging this flaw can perform local credential harvesting to obtain private keys that are typically protected by operating system file permissions. This capability significantly lowers the barrier for lateral movement and privilege escalation within a network, particularly in enterprise environments where shared workstations or multi-user servers are common.
Mitigation strategies must focus on both immediate remediation and long-term architectural improvements. The primary solution is to upgrade FreeRDP to version 3.32.0 or later, where the developers have corrected the permission assignment logic within the crypto_write_pem function to ensure that generated private keys are created with restrictive permissions, typically mode 600, which allows access only to the file owner. In environments where upgrading is not immediately feasible, administrators should consider restricting access to shared temporary directories such as /tmp or /var/tmp through mount options like noexec and nodev, although this does not fully mitigate read access if standard umask settings are permissive. Additionally, enforcing stricter system-wide umask values can reduce the risk of world-readable file creation across various applications, though it is a less targeted approach than patching the specific vulnerability in FreeRDP itself. Regular auditing of temporary directory contents and monitoring for unusual file creation patterns by non-root users can also aid in detecting exploitation attempts before significant damage occurs.