CVE-2026-109244 FreeRDP 2.0.0 before 3.32.0 Insecure Private Key Permissions in winpr-makecert
Local attackers can read world-readable private keys generated by winpr-makecert, leading to credential theft on multi-user systems.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2026-109244?
CVE-2026-109244 is a medium-severity vulnerability in FreeRDP, published on 12 Oct 2026. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.
Official description
FreeRDP from 2.0.0 before 3.32.0 contains an insecure permission vulnerability in winpr-makecert that creates unencrypted private keys without owner-only file modes. Local users on multi-user Unix hosts can read world-readable key files or open PFX files protected by the hard-coded default password to steal private keys.
Weakness: CWE-732
Which versions are affected by CVE-2026-109244?
How do I fix CVE-2026-109244?
Upgrade to a fixed version.
Is CVE-2026-109244 being exploited?
There is no known exploitation of CVE-2026-109244 in the wild and no public exploit code.
Sources
Also known as DEBIAN-CVE-2026-109244, GHSA-2jfv-j3wx-5cg4, GHSA-jww6-v76j-hqqx, UBUNTU-CVE-2026-109244.