CVE-2026-85028

Creation of Temporary File in Directory with Insecure Permissions in AWS FPGA Development Kit

State: Published
Severity: 7.3 High
Published: Sep 3, 2026
Updated: Sep 3, 2026
Reserved: Sep 2, 2026

Description

Creation of a temporary file in a directory with insecure permissions in the FPGA management tool installation component in AWS FPGA Development Kit (aws-fpga) before 2.3.4 might allow local users to execute arbitrary code with root privileges via crafted shell content placed at a predictable path in a world-writable temporary directory, which the installation step reads after elevating its own privileges.

To remediate this issue, users should upgrade to version 2.3.4.

Scores

CVSS	Score	Vector	Source
4.0	7.3 High	CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N	AMZN
3.1	7.8 High	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H	AMZN

Weaknesses

CWE-379 Creation of temporary file in directory with insecure permissions

Affected Products

Product	Versions
aws-fpgaAWS	before 2.3.4Affected

References

https://github.com/aws/aws-fpga/releases/tag/v2.3.4release-notespatch
https://aws.amazon.com/security/security-bulletins/2026-096-aws/vendor-advisory
https://github.com/aws/aws-fpga/security/advisories/GHSA-g4hc-wrmm-2x74release-notes

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.