CVE-2026-109244 in FreeRDP
Summary
by MITRE • 10/12/2026
FreeRDP from 2.0.0 before 3.32.0 contains an insecure permission vulnerability in winpr-makecert that creates unencrypted private keys without owner-only file modes. Local users on multi-user Unix hosts can read world-readable key files or open PFX files protected by the hard-coded default password to steal private keys.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 10/12/2026
The vulnerability identified within FreeRDP versions ranging from 2.0.0 up to, but not including, version 3.32.0 represents a critical failure in cryptographic key management and operating system file permission enforcement. Specifically, the flaw resides in the winpr-makecert utility component of the Windows Portable Runtime library integrated into FreeRDP. When this tool generates X.509 certificates for authentication or encryption purposes, it creates private keys that are stored on disk without applying restrictive owner-only file permissions. In Unix-like operating systems, default file creation modes often allow read and write access to users other than the file creator if not explicitly restricted by a umask setting or explicit chmod call. This oversight results in private key files being created with world-readable permissions, exposing sensitive cryptographic material to any local user on the system.
From an operational perspective, this misconfiguration allows unauthorized local users to intercept and extract private keys intended for secure communications. Since these keys are stored unencrypted and accessible to all users, attackers can simply read the file contents from the filesystem without needing to exploit a separate software bug or gain elevated privileges beyond basic user access. Furthermore, in scenarios where PFX (Personal Information Exchange) files are generated using this utility, they may be protected by hard-coded default passwords rather than strong, unique passphrases. This dual failure of weak encryption and accessible storage significantly lowers the barrier for attackers to compromise identity assets, facilitating unauthorized impersonation or decryption of previously captured traffic if session keys were derived from these compromised certificates.
This vulnerability aligns with CWE-732, which describes improper permission assignment for critical resources, as well as CWE-916 regarding the use of hard-coded credentials in security-critical contexts. The attack vector is classified under Local Privilege Escalation or Credential Access within the MITRE ATT&CK framework, specifically mapping to techniques such as T1552 Unsecured Credentials where an adversary seeks to find and extract unencrypted credential material from a local system. The impact extends beyond simple key theft; it undermines the integrity of mutual authentication mechanisms in FreeRDP deployments, potentially allowing man-in-the-middle attacks if compromised certificates are used to establish trusted sessions with other systems.
Mitigation strategies must focus on both immediate remediation and long-term architectural improvements. Users should upgrade immediately to version 3.32.0 or later where this permission handling has been corrected to enforce restrictive file modes, ensuring private keys are only accessible by the owning user process. For environments unable to patch immediately, administrators can implement manual safeguards such as configuring strict umask values for the service account running FreeRDP and auditing directory permissions regularly to detect any world-readable key files. Additionally, it is crucial to ensure that all certificate generation processes utilize strong, randomly generated passphrases rather than relying on default or hardcoded credentials, thereby adding a layer of encryption protection even if file access controls are inadvertently bypassed.