CVE-2026-109243 FreeRDP CVE debrief

Who should care

Unix-based system administrators and security teams with multiple users should review and update FreeRDP to version 3.32.0 or later. Affected operator, platform, vulnerability-management, and security-team impact should be considered when assessing this vulnerability. Local attackers can read sensitive private keys, and multi-user Unix hosts are vulnerable to exploitation. Verify permissions on soft-smartcard private key files and monitor Unix-basedsystems

Why it matters

CVE-2026-109243 is a medium-severity vulnerability in FreeRDP that allows local users to read private keys without owner-only permissions. Unix-based system administrators and security teams with multiple users should review and update FreeRDP to version 3.32.0 or later.

• Local attackers can read sensitive private keys
• Multi-user Unix hosts are vulnerable to exploitation
• Verify permissions on soft-smartcard private key files

Technical summary

The vulnerability allows local users to read private keys written by crypto_write_pem without owner-only permissions. Attackers on multi-user Unix hosts can enumerate the shared temporary directory during soft-smartcard logon to read the world-readable PKINIT private-key copy. This vulnerability affects FreeRDP from 3.0.0 before 3.32.0 and has a medium-severity CVSS score of 4.1. Unix-based system administrators and security teams with multiple users should review and update FreeRDP to version 3.32.0 or later to mitigate this vulnerability.

Defensive priority

Medium priority for Unix-based systems with multiple users

Recommended defensive actions

• Review and update FreeRDP to version 3.32.0 or later
• Verify permissions on soft-smartcard private key files
• Monitor Unix-based systems with multiple users for potential exploitation
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed
• Check relevant monitoring, detection, and logs for exposed assets that need extra review

Evidence notes

The CVE Program record and NVD vulnerability detail provide official information about the vulnerability. The source item and supplemental sources offer additional context. Affected product deployments should be confirmed in managed environments, and an owner should be assigned for follow-up. The vulnerability allows local users to read private keys written by crypto_write_pem without owner-only permissions.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.