FreeRDP 2.0.0 through 3.31.999 includes a file permission issue in winpr‑makecert that writes unencrypted private keys with globally readable permissions or generates PFX files protected only by a hard‑coded default password. The flaw is identified as CWE‑276 and CWE‑732 and allows an attacker with local user rights on a multi‑user Unix system to read these key files, thereby compromising private credentials and enabling further credential‑based attacks.

The affected product is FreeRDP, all releases from 2.0.0 up to but not including 3.32.0. The issue manifests on multi‑user Unix hosts where winpr‑makecert is invoked to create certificates.

The CVSS score of 6.8 indicates a medium severity impact. EPSS score of <1% indicates a very low probability of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog, suggesting limited evidence of exploitation. The likely attack vector is a local user on a shared Unix system who can run winpr‑makecert or subsequently access the generated files, as inferred from the description.