CVE-2026-85028
Received Received - Intake

Temporary File Creation Flaw in AWS FPGA Development Kit

Publication date: 2026-09-03

Last updated on: 2026-09-03

Assigner: AMZN

Description
Creation of a temporary file in a directory with insecure permissions in the FPGA management tool installation component in AWS FPGA Development Kit (aws-fpga) before 2.3.4 might allow local users to execute arbitrary code with root privileges via crafted shell content placed at a predictable path in a world-writable temporary directory, which the installation step reads after elevating its own privileges. To remediate this issue, users should upgrade to version 2.3.4.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-03
Last Modified
2026-09-03
Generated
2026-09-04
AI Q&A
2026-09-03
EPSS Evaluated
N/A
NVD
CVE-2026-85028
EUVD
EUVD-2026-70652

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
aws fpga_development_kit 2.3.4
aws aws_fpga 2.3.4

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-379 The product creates a temporary file in a directory whose permissions allow unintended actors to determine the file's existence or otherwise access that file.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability involves a temporary file created during installation of the AWS FPGA Development Kit with insecure permissions. A local user could place malicious shell content in a predictable world-writable directory. When the installation process runs with elevated privileges, it reads and executes this content, allowing arbitrary code execution with root privileges.

Detection Guidance

This vulnerability involves insecure permissions in a temporary directory used by the AWS FPGA Development Kit. Check for world-writable temporary directories with predictable paths, especially during installation. Look for files created in /tmp or similar directories with unusual shell content. No specific commands are provided in the context.

Impact Analysis

If exploited, this vulnerability could allow an attacker with local access to gain full control of your system by executing arbitrary code as root. This could lead to complete system compromise, data theft, or further network infiltration.

Compliance Impact

This vulnerability could potentially impact compliance with standards like GDPR and HIPAA by enabling unauthorized local privilege escalation to root on affected systems. Such access could lead to unauthorized data access, modification, or exfiltration, violating confidentiality and integrity requirements of these regulations.

Mitigation Strategies

Upgrade the AWS FPGA Development Kit to version 2.3.4 or later to address the insecure temporary file creation issue. Ensure no temporary directories or files created by the tool have world-writable permissions.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-85028. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart