CVE-2026-109244
Medium · 6.6CVSS
6.6
EPSS
0.1%
Published
Oct 12, 2026
CISA due date
—
The record
FreeRDP from 2.0.0 before 3.32.0 contains an insecure permission vulnerability in winpr-makecert that creates unencrypted private keys without owner-only file modes. Local users on multi-user Unix hosts can read world-readable key files or open PFX files protected by the hard-coded default password to steal private keys.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|
Related vulnerabilities
- CVE-2026-120066 On Unix-like systems, when logging is enabled, psqlODBC creates its log files in /tmp by… CWE-732
- CVE-2026-91906 Dell OpenManage Enterprise, versions prior to 4.8.0, contains an Incorrect Permission… CWE-732
- CVE-2026-91904 Dell OpenManage Enterprise, versions prior to 4.8.0, contains an Incorrect Permission… CWE-732
- CVE-2026-68591 In Modem, there is a possible escalation of privilege due to a permissions bypass. CWE-732
- CVE-2026-111499 Dell OpenManage Enterprise, versions prior to 4.8.0, contains an Incorrect Permission… CWE-732
- CVE-2026-118574 Incorrect Permission Assignment for Critical Resource vulnerability in Drupal S3 File… CWE-732
- CVE-2026-107060 Insecure permissions in Tailscale versionCode 297862600 allows unauthorized attackers to… CWE-732
- CVE-2026-107055 Insecure permissions in the autosave component of AppML neutriNote CE versionCode 1387… CWE-732