Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
8.4

AWS FPGA kit lets local users run code as root

CVE-2026-85028 · published 2 months ago
Summary

The FPGA management tool in the AWS FPGA Development Kit (versions before 2.3.4) creates temporary files in a folder that anyone can write to. A user on the same machine could place malicious content in that folder and have it executed with full system privileges when the tool runs. Upgrading the kit to version 2.3.4 resolves the issue.

What to do
  • Update aws aws-fpga to version 2.3.4 or later.
Affected software
VendorProductAffected versions
aws aws-fpga < 2.3.4
Original advisory text
Creation of Temporary File in Directory with Insecure Permissions in AWS FPGA Development Kit
Creation of a temporary file in a directory with insecure permissions in the FPGA management tool installation component in AWS FPGA Development Kit (aws-fpga) before 2.3.4 might allow local users to execute arbitrary code with root privileges via crafted shell content placed at a predictable path in a world-writable temporary directory, which the installation step reads after elevating its own privileges.



To remediate this issue, users should upgrade to version 2.3.4.
References
Fix within
Internet-facing 14 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit
  • Gives an attacker full control
Severity
8.4 High
Exploitation
<1% chance of attack within 30 days
Type
CWE-379Creation of Temporary File in Directory with Insecure Permissions
Timeline
Published3 Sep 2026
Updated26 Oct 2026
First seen3 Sep 2026
Sources
CVE-2026-85028 · NVD
CVE-2026-85028 · MITRE
CVE-2026-85028 · OSV
GHSA-g4hc-wrmm-2x74 · GHSA
Track software like this
Free during beta