FreeRDP CVE-2026-109243

Exploitation requires ALL of: (1) a multi-user Unix/Linux host where the attacker already holds a local, unprivileged account (PR:L); (2) the FreeRDP soft-smartcard / PKINIT logon flow being used, which triggers crypto_write_pem to write the private-key copy into a shared temporary directory; and (3) a victim actually performing such a logon during the attacker's monitoring window (the AT:P/UI:P attack requirement). The exposure is the world-readable permission on the written PEM file. LIMITING FACTORS: it is not remotely exploitable, it yields no write/integrity or availability impact, and it is inert on single-user hosts or deployments that do not use soft-smartcard PKINIT logon - substantially narrowing real-world applicability despite FreeRDP's broad install base.

This is a genuinely low-to-moderate priority local information-disclosure flaw, and the multiple signals agree rather than conflict. The vendor CVSS 4.0 vector (AV:L/AC:L/AT:P/PR:L/UI:P, score 4.1) and the facts in the description are mutually consistent: exploitation is strictly local (AV:L), requires an already-authenticated local account on the host (PR:L), and depends on a condition outside the attacker's control - a legitimate user performing a soft-smartcard PKINIT logon that writes the private-key copy (captured as AT:P/UI:P). Impact is confidentiality-only (VC:H, VI:N/VA:N): disclosure of a PKINIT private key, which is serious if obtained but confined to read access. There is no CISA KEV listing and no public exploit referenced, so this is 'no public exploit identified at time of analysis' - not active exploitation. No EPSS score was provided in the input, so probability-of-exploitation cannot be quantified here. The practical risk is bounded to multi-user Unix hosts running affected FreeRDP (3.0.0 to <3.32.0) with soft-smartcard logon - a specific deployment pattern - so this warrants routine patching rather than emergency response, with higher urgency on shared/multi-tenant Unix systems.

On a shared multi-user Linux host, a low-privileged local user monitors the world-readable shared temporary directory while another user initiates a FreeRDP soft-smartcard (PKINIT) logon. FreeRDP's crypto_write_pem writes the PKINIT private-key copy without owner-only permissions, so the attacker reads the private key from the temp file and can impersonate the victim's smartcard-based authentication. No public proof-of-concept is referenced in the available data.