CVE-2026-109243
Medium · 4.4CVSS
4.4
EPSS
0.1%
Published
Oct 12, 2026
CISA due date
—
The record
FreeRDP from 3.0.0 before 3.32.0 contains an incorrect permission assignment vulnerability that allows local users to read private keys written by crypto_write_pem without owner-only permissions. Attackers on multi-user Unix hosts can enumerate the shared temporary directory during soft-smartcard logon to read the world-readable PKINIT private-key copy.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|
Related vulnerabilities
- CVE-2026-120066 On Unix-like systems, when logging is enabled, psqlODBC creates its log files in /tmp by… CWE-732
- CVE-2026-91906 Dell OpenManage Enterprise, versions prior to 4.8.0, contains an Incorrect Permission… CWE-732
- CVE-2026-91904 Dell OpenManage Enterprise, versions prior to 4.8.0, contains an Incorrect Permission… CWE-732
- CVE-2026-68591 In Modem, there is a possible escalation of privilege due to a permissions bypass. CWE-732
- CVE-2026-111499 Dell OpenManage Enterprise, versions prior to 4.8.0, contains an Incorrect Permission… CWE-732
- CVE-2026-118574 Incorrect Permission Assignment for Critical Resource vulnerability in Drupal S3 File… CWE-732
- CVE-2026-107060 Insecure permissions in Tailscale versionCode 297862600 allows unauthorized attackers to… CWE-732
- CVE-2026-107055 Insecure permissions in the autosave component of AppML neutriNote CE versionCode 1387… CWE-732