Every CVE Search/ Get API key

CVE-2026-109244

FreeRDP 2.0.0 before 3.32.0 Insecure Private Key Permissions in winpr-makecert

6.8 MediumFix available

FreeRDP from 2.0.0 before 3.32.0 contains an insecure permission vulnerability in winpr-makecert that creates unencrypted private keys without owner-only file modes. Local users on multi-user Unix hosts can read world-readable key files or open PFX files protected by the hard-coded default password to steal private keys.

Attack profile

How easy it is to exploit

Attack vector
Local
Complexity
Low
Privileges needed
Low
User interaction
Passive

What an attacker can affect

Confidentiality
High
Integrity
High
Availability
None

Exploit likelihood

0.14%Unchanged since Oct 13, 2026
90%50%10%1%

What each source reports

CVE List Score used 6.8

FreeRDP 2.0.0 before 3.32.0 Insecure Private Key Permissions in winpr-makecert

FreeRDP from 2.0.0 before 3.32.0 contains an insecure permission vulnerability in winpr-makecert that creates unencrypted private keys without owner-only file modes. Local users on multi-user Unix hosts can read world-readable key files or open PFX files protected by the hard-coded default password to steal private keys.

Record
CVE-2026-109244
CVSS 4.0
6.8 MediumCVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
CVSS 3.1
6.6 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N
Weakness
CWE-732
Updated
2026-11-02
EUVDEUVD-2026-97688 6.8

FreeRDP from 2.0.0 before 3.32.0 contains an insecure permission vulnerability in winpr-makecert that creates unencrypted private keys without owner-only file modes. Local users on multi-user Unix hosts can read world-readable key files or open PFX files protected by the hard-coded default password to steal private keys.

Record
EUVD-2026-97688
CVSS 4.0
6.8 MediumCVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
Updated
2026-11-02
GitHub AdvisoriesGHSA-jww6-v76j-hqqx 6.8

FreeRDP from 2.0.0 before 3.32.0 contains an insecure permission vulnerability in winpr-makecert...

FreeRDP from 2.0.0 before 3.32.0 contains an insecure permission vulnerability in winpr-makecert that creates unencrypted private keys without owner-only file modes. Local users on multi-user Unix hosts can read world-readable key files or open PFX files protected by the hard-coded default password to steal private keys.

Record
GHSA-jww6-v76j-hqqx
CVSS 4.0
6.8 MediumCVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS 3.1
6.6 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N
Weakness
CWE-732
Updated
2026-11-02
NVD 6.8

FreeRDP from 2.0.0 before 3.32.0 contains an insecure permission vulnerability in winpr-makecert that creates unencrypted private keys without owner-only file modes. Local users on multi-user Unix hosts can read world-readable key files or open PFX files protected by the hard-coded default password to steal private keys.

Record
CVE-2026-109244
CVSS 4.0
6.8 MediumCVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS 3.1
6.6 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N
Weakness
CWE-732
Updated
2026-11-03
OSV 6.8

FreeRDP 2.0.0 before 3.32.0 Insecure Private Key Permissions in winpr-makecert

FreeRDP from 2.0.0 before 3.32.0 contains an insecure permission vulnerability in winpr-makecert that creates unencrypted private keys without owner-only file modes. Local users on multi-user Unix hosts can read world-readable key files or open PFX files protected by the hard-coded default password to steal private keys.

Record
CVE-2026-109244
CVSS 4.0
6.8 MediumCVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
Weakness
CWE-732
Updated
2026-11-04
OSVDEBIAN-CVE-2026-109244 6.8

FreeRDP from 2.0.0 before 3.32.0 contains an insecure permission vulnerability in winpr-makecert that creates unencrypted private keys without owner-only file modes. Local users on multi-user Unix hosts can read world-readable key files or open PFX files protected by the hard-coded default password to steal private keys.

Record
DEBIAN-CVE-2026-109244
CVSS 4.0
6.8 MediumCVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Updated
2026-11-03
OSVUBUNTU-CVE-2026-109244 6.8

FreeRDP from 2.0.0 before 3.32.0 contains an insecure permission vulnerability in winpr-makecert that creates unencrypted private keys without owner-only file modes. Local users on multi-user Unix hosts can read world-readable key files or open PFX files protected by the hard-coded default password to steal private keys.

Record
UBUNTU-CVE-2026-109244
CVSS 4.0
6.8 MediumCVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
CVSS 3.1
6.6 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N
Updated
2026-11-02
OSVCLSA-2026-1792805697 No score

freerdp: Fix of 5 CVEs

  • CVE-2026-111880: fix heap out-of-bounds write in NTLM MIC computation; validate the MIC offset against the AUTHENTICATE_MESSAGE length
  • CVE-2023-39354: fix out-of-bounds read in nsc_rle_decompress_data; check that the stream holds the declared plane lengths
  • CVE-2026-109244: winpr-makecert: create key and certificate files with owner-only permissions and use a random export password
  • CVE-2026-109257: NSCodec encoder: free plane buffers in one place to avoid a double free
  • CVE-2026-109677: smartcard: validate cbAtr against the rgbAtr size when unpacking LocateCardsByATR and reader states
  • CVE-2026-111377: server: abort static channel reassembly when fragments exceed the declared total size
Record
CLSA-2026-1792805697
Updated
2026-11-02
OSVCLSA-2026-1792808931 No score

freerdp: Fix of 2 CVEs

  • CVE-2026-111880: fix heap out-of-bounds write in NTLM MIC computation; validate the MIC offset against the AUTHENTICATE_MESSAGE length
  • CVE-2023-39354: fix out-of-bounds read in nsc_rle_decompress_data; check that the stream holds the declared plane lengths
  • CVE-2026-109244: winpr-makecert: create key and certificate files with owner-only permissions and use a random export password
  • CVE-2026-109257: NSCodec encoder: free plane buffers in one place to avoid a double free
  • CVE-2026-109677: smartcard: validate cbAtr against the rgbAtr size when unpacking LocateCardsByATR and reader states
  • CVE-2026-111377: server: abort static channel reassembly when fragments exceed the declared total size
Record
CLSA-2026-1792808931
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
freerdp
TuxCare:OracleLinux:7
From an advisory covering 6 CVEs
 before 2.1.1-5.0.9.el7_9.tuxcare.els8
2.1.1-5.0.9.el7_9.tuxcare.els8
freerdp-devel
TuxCare:OracleLinux:7
From an advisory covering 6 CVEs
 before 2.1.1-5.0.9.el7_9.tuxcare.els8
2.1.1-5.0.9.el7_9.tuxcare.els8
freerdp-libs
TuxCare:OracleLinux:7
From an advisory covering 6 CVEs
 before 2.1.1-5.0.9.el7_9.tuxcare.els8
2.1.1-5.0.9.el7_9.tuxcare.els8
libwinpr
TuxCare:OracleLinux:7
From an advisory covering 6 CVEs
 before 2.1.1-5.0.9.el7_9.tuxcare.els8
2.1.1-5.0.9.el7_9.tuxcare.els8
libwinpr-devel
TuxCare:OracleLinux:7
From an advisory covering 6 CVEs
 before 2.1.1-5.0.9.el7_9.tuxcare.els8
2.1.1-5.0.9.el7_9.tuxcare.els8
freerdp
TuxCare:RHEL:7
From an advisory covering 6 CVEs
 before 2.1.1-5.0.9.el7_9.tuxcare.els8
2.1.1-5.0.9.el7_9.tuxcare.els8
freerdp-devel
TuxCare:RHEL:7
From an advisory covering 6 CVEs
 before 2.1.1-5.0.9.el7_9.tuxcare.els8
2.1.1-5.0.9.el7_9.tuxcare.els8
freerdp-libs
TuxCare:RHEL:7
From an advisory covering 6 CVEs
 before 2.1.1-5.0.9.el7_9.tuxcare.els8
2.1.1-5.0.9.el7_9.tuxcare.els8
libwinpr
TuxCare:RHEL:7
From an advisory covering 6 CVEs
 before 2.1.1-5.0.9.el7_9.tuxcare.els8
2.1.1-5.0.9.el7_9.tuxcare.els8
libwinpr-devel
TuxCare:RHEL:7
From an advisory covering 6 CVEs
 before 2.1.1-5.0.9.el7_9.tuxcare.els8
2.1.1-5.0.9.el7_9.tuxcare.els8
Show 11 moreShow less
Affected packages
PackageAffectedFixed
freerdp2
Debian:12
 All versions, plus listed versions
2.10.0+dfsg1-12.10.0+dfsg1-1.12.11.2+dfsg1-12.11.2+dfsg1-1.1~exp12.11.2+dfsg1-1.1~exp2
Show 8 moreShow less
2.11.5+dfsg1-12.11.7+dfsg1-12.11.7+dfsg1-22.11.7+dfsg1-32.11.7+dfsg1-42.11.7+dfsg1-52.11.7+dfsg1-62.11.7+dfsg1-6~deb12u1
 None known
freerdp3
Debian:13
 All versions, plus listed versions
3.15.0+dfsg-2.13.15.0+dfsg-2.1+deb13u13.15.0+dfsg-2.1+deb13u23.15.0+dfsg-2.1+deb13u33.16.0+dfsg-1
Show 45 moreShow less
3.16.0+dfsg-23.17.0+dfsg-13.17.1+dfsg-13.17.1+dfsg-23.17.2+dfsg-13.17.2+dfsg-23.17.2+dfsg-33.18.0+dfsg-13.19.0+dfsg-13.19.1+dfsg-13.20.0+dfsg-13.20.2+dfsg-13.21.0+dfsg-13.22.0+dfsg-13.22.0+dfsg-1~bpo13+03.22.0+dfsg-1~bpo13+13.22.0+dfsg-33.23.0+dfsg-13.23.0+dfsg-1~bpo13+13.24.0+dfsg-13.24.0+dfsg-23.24.1+dfsg-13.24.2+dfsg-13.24.2+dfsg-1~bpo13+13.25.0+dfsg-13.25.0+dfsg-23.25.0+dfsg-33.25.0+dfsg-43.25.0+dfsg-53.26.0+dfsg-13.26.0+dfsg-1~bpo13+13.27.0+dfsg-13.27.1+dfsg-13.28.0+dfsg-13.28.0+dfsg-23.29.0+dfsg-13.30.0+dfsg-13.30.0+dfsg-1~bpo13+13.31.0+dfsg-13.31.1+dfsg-13.31.1+dfsg-1~bpo13+13.32.0+dfsg-13.32.1+dfsg-13.32.1+dfsg-1~bpo13+13.32.2+dfsg-1
 None known
freerdp3
Debian:14
 before 3.32.0+dfsg-1, plus listed versions
3.15.0+dfsg-2.13.16.0+dfsg-13.16.0+dfsg-23.17.0+dfsg-13.17.1+dfsg-1
Show 38 moreShow less
3.17.1+dfsg-23.17.2+dfsg-13.17.2+dfsg-23.17.2+dfsg-33.18.0+dfsg-13.19.0+dfsg-13.19.1+dfsg-13.20.0+dfsg-13.20.2+dfsg-13.21.0+dfsg-13.22.0+dfsg-13.22.0+dfsg-1~bpo13+03.22.0+dfsg-1~bpo13+13.22.0+dfsg-33.23.0+dfsg-13.23.0+dfsg-1~bpo13+13.24.0+dfsg-13.24.0+dfsg-23.24.1+dfsg-13.24.2+dfsg-13.24.2+dfsg-1~bpo13+13.25.0+dfsg-13.25.0+dfsg-23.25.0+dfsg-33.25.0+dfsg-43.25.0+dfsg-53.26.0+dfsg-13.26.0+dfsg-1~bpo13+13.27.0+dfsg-13.27.1+dfsg-13.28.0+dfsg-13.28.0+dfsg-23.29.0+dfsg-13.30.0+dfsg-13.30.0+dfsg-1~bpo13+13.31.0+dfsg-13.31.1+dfsg-13.31.1+dfsg-1~bpo13+1
3.32.0+dfsg-1
freerdp
Ubuntu:16.04:LTS
 All versions, plus listed versions
1.1.0~git20140921.1.440916e+dfsg1-5ubuntu11.1.0~git20140921.1.440916e+dfsg1-5ubuntu1.21.1.0~git20140921.1.440916e+dfsg1-5ubuntu1.31.1.0~git20140921.1.440916e+dfsg1-5ubuntu1.4
 None known
freerdp2
Ubuntu:Pro:18.04:LTS
 All versions, plus listed versions
2.0.0~git20170725.1.1648deb+dfsg1-12.0.0~git20170725.1.1648deb+dfsg1-52.0.0~git20170725.1.1648deb+dfsg1-5ubuntu12.0.0~git20170725.1.1648deb+dfsg1-5ubuntu22.0.0~git20170725.1.1648deb+dfsg1-6
Show 14 moreShow less
2.0.0~git20170725.1.1648deb+dfsg1-6build12.0.0~git20170725.1.1648deb+dfsg1-72.0.0~git20170725.1.1648deb+dfsg1-7ubuntu0.12.1.1+dfsg1-0ubuntu0.18.04.12.2.0+dfsg1-0ubuntu0.18.04.12.2.0+dfsg1-0ubuntu0.18.04.22.2.0+dfsg1-0ubuntu0.18.04.32.2.0+dfsg1-0ubuntu0.18.04.42.2.0+dfsg1-0ubuntu0.18.04.4+esm12.2.0+dfsg1-0ubuntu0.18.04.4+esm22.2.0+dfsg1-0ubuntu0.18.04.4+esm32.2.0+dfsg1-0ubuntu0.18.04.4+esm42.2.0+dfsg1-0ubuntu0.18.04.4+esm52.2.0+dfsg1-0ubuntu0.18.04.4+esm6
 None known
freerdp
Ubuntu:18.04:LTS
 All versions, plus listed versions
1.1.0~git20140921.1.440916e+dfsg1-15ubuntu11.1.0~git20140921.1.440916e+dfsg1-15ubuntu1.18.04.11.1.0~git20140921.1.440916e+dfsg1-15ubuntu1.18.04.2
 None known
freerdp2
Ubuntu:Pro:20.04:LTS
 All versions, plus listed versions
2.0.0~git20190204.1.2693389a+dfsg1-12.0.0~git20190204.1.2693389a+dfsg1-22.0.0~git20190204.1.2693389a+dfsg1-2build12.0.0~git20190204.1.2693389a+dfsg1-2build22.1.1+dfsg1-0ubuntu0.20.04.1
Show 12 moreShow less
2.2.0+dfsg1-0ubuntu0.20.04.12.2.0+dfsg1-0ubuntu0.20.04.22.2.0+dfsg1-0ubuntu0.20.04.32.2.0+dfsg1-0ubuntu0.20.04.42.2.0+dfsg1-0ubuntu0.20.04.52.2.0+dfsg1-0ubuntu0.20.04.62.6.1+dfsg1-0ubuntu0.20.04.12.6.1+dfsg1-0ubuntu0.20.04.22.6.1+dfsg1-0ubuntu0.20.04.2+esm12.6.1+dfsg1-0ubuntu0.20.04.2+esm22.6.1+dfsg1-0ubuntu0.20.04.2+esm32.6.1+dfsg1-0ubuntu0.20.04.2+esm4
 None known
freerdp2
Ubuntu:22.04:LTS
 All versions, plus listed versions
2.3.0+dfsg1-2build12.3.0+dfsg1-2ubuntu12.3.0+dfsg1-2ubuntu22.4.1+dfsg1-12.4.1+dfsg1-1ubuntu1
Show 18 moreShow less
2.4.1+dfsg1-1ubuntu22.5.0+dfsg1-12.6.0+dfsg1-12.6.1+dfsg1-12.6.1+dfsg1-32.6.1+dfsg1-3ubuntu12.6.1+dfsg1-3ubuntu22.6.1+dfsg1-3ubuntu2.12.6.1+dfsg1-3ubuntu2.22.6.1+dfsg1-3ubuntu2.32.6.1+dfsg1-3ubuntu2.42.6.1+dfsg1-3ubuntu2.52.6.1+dfsg1-3ubuntu2.62.6.1+dfsg1-3ubuntu2.72.6.1+dfsg1-3ubuntu2.82.6.1+dfsg1-3ubuntu2.92.6.1+dfsg1-3ubuntu2.102.6.1+dfsg1-3ubuntu2.11
 None known
freerdp3
Ubuntu:24.04:LTS
 before 3.32.0+dfsg-0ubuntu0.24.04.1, plus listed versions
3.4.0+dfsg1-0ubuntu23.4.0+dfsg1-0ubuntu33.4.0+dfsg1-0ubuntu43.5.0+dfsg1-0ubuntu13.5.1+dfsg1-0ubuntu1
Show 8 moreShow less
3.5.1+dfsg1-0ubuntu1.13.5.1+dfsg1-0ubuntu1.23.5.1+dfsg1-0ubuntu1.43.5.1+dfsg1-0ubuntu1.53.5.1+dfsg1-0ubuntu1.63.30.0+dfsg-0ubuntu0.24.04.13.30.0+dfsg-0ubuntu0.24.04.23.31.0+dfsg-0ubuntu0.24.04.1
3.32.0+dfsg-0ubuntu0.24.04.1
freerdp2
Ubuntu:Pro:24.04:LTS
 All versions, plus listed versions
2.10.0+dfsg1-1.1ubuntu12.11.2+dfsg1-12.11.2+dfsg1-1build12.11.2+dfsg1-1build32.11.5+dfsg1-1build1
Show 7 moreShow less
2.11.5+dfsg1-1build22.11.5+dfsg1-1ubuntu0.1~esm12.11.5+dfsg1-1ubuntu0.1~esm22.11.5+dfsg1-1ubuntu0.1~esm32.11.5+dfsg1-1ubuntu0.1~esm42.11.5+dfsg1-1ubuntu0.1~esm52.11.5+dfsg1-1ubuntu0.1~esm6
 None known
freerdp3
Ubuntu:26.04:LTS
 before 3.32.0+dfsg-0ubuntu0.26.04.1, plus listed versions
3.16.0+dfsg-23.18.0+dfsg-1ubuntu13.19.0+dfsg-13.19.1+dfsg-13.20.0+dfsg-1
Show 9 moreShow less
3.20.2+dfsg-13.21.0+dfsg-13.22.0+dfsg-13.24.1+dfsg-1ubuntu13.24.2+dfsg-1ubuntu13.24.2+dfsg-1ubuntu1.13.30.0+dfsg-0ubuntu0.26.04.13.30.0+dfsg-0ubuntu0.26.04.23.31.0+dfsg-0ubuntu0.26.04.1
3.32.0+dfsg-0ubuntu0.26.04.1

History

History
RecordedChangedSources
affected
factsOSV
affectedOSV
referencesNVD
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-109244 is a medium vulnerability (CVSS 6.8) in Freerdp, published October 12, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.14%, the 3rd percentile. Fixed in freerdp3 3.32.0+dfsg-1.

References

Show 8 moreShow less
This page doesn't list everything

Left out here: 1 version. The JSON record has them.

Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open