CVE-2026-85028

CVE-2026-85028 is a local privilege escalation flaw caused by the FPGA management tool installation component of the AWS FPGA Development Kit (aws-fpga) creating temporary files in a world-writable temporary directory with insecure permissions (CWE-379). A local attacker with low privileges can pre-place crafted shell content at a predictable path in that directory; when the installation step elevates its own privileges and later reads the file, the attacker's shell content is executed. Successful exploitation gives the attacker arbitrary code execution with root privileges on the affected host. Only users running aws-fpga versions before 2.3.4 who execute the FPGA management tool installation step, particularly on shared or multi-user systems, are exposed. No public proof-of-concept, in-the-wild exploitation, or CISA KEV listing is known, and EPSS estimates only about a 0.1% probability of exploitation in the next 30 days.

What to do: Upgrade aws-fpga to version 2.3.4. Until patched, avoid running the FPGA management tool installation step with elevated privileges on shared or multi-user hosts, and secure or clear the world-writable temporary directory it uses. Administrators of F1 instances and FPGA development machines should check for untrusted files at predictable paths in the temporary directory and review for unexpected root-level activity.