FreeRDP versions 3.0.0 through 3.31.x incorrectly grant world‑readable permissions to the temporary private‑key file created during a soft‑smartcard logon. This weakness, identified as CWE‑378, permits any local user on a multi‑user Unix host to read private keys that should be accessible only to the owning process or user. The consequence is the exfiltration of PKINIT private keys, which undermines the confidentiality of all credentials stored or transmitted using that key.

The vulnerability affects the FreeRDP project, specifically all releases from 3.0.0 up to and including 3.31.x. Users running these versions on Unix‑like operating systems are at risk.

The CVSS score is 4.1, indicating a moderate threat potential. The EPSS score is < 1%, and the vulnerability is not listed in CISA's KEV catalog, suggesting limited known exploitation. Attackers would need local access on a multi‑user host and would exploit the soft‑smartcard feature’s temporary directory. Because the flaw relies on local privilege, it does not enable remote code execution but allows data compromise of sensitive key material.