CVE-2026-109243 FreeRDP 3.0.0 before 3.32.0 Insecure Permissions on Soft-Smartcard Private Key File
Local attackers can read world-readable private key files during soft-smartcard logon, exposing sensitive cryptographic material on multi-user systems.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2026-109243?
CVE-2026-109243 is a medium-severity vulnerability in FreeRDP, published on 12 Oct 2026. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.
Official description
FreeRDP from 3.0.0 before 3.32.0 contains an incorrect permission assignment vulnerability that allows local users to read private keys written by crypto_write_pem without owner-only permissions. Attackers on multi-user Unix hosts can enumerate the shared temporary directory during soft-smartcard logon to read the world-readable PKINIT private-key copy.
Weakness: CWE-732
Which versions are affected by CVE-2026-109243?
How do I fix CVE-2026-109243?
Upgrade to a fixed version.
Is CVE-2026-109243 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-109243 exists.
Sources
Also known as DEBIAN-CVE-2026-109243, GHSA-p86r-cw4x-6prq, GHSA-q9p9-j22r-577p, UBUNTU-CVE-2026-109243.