Creation of a temporary file in a directory with insecure permissions in the FPGA management tool installation component in AWS FPGA Development Kit (aws-fpga) before 2.3.4 might allow local users to execute arbitrary code with root privileges via crafted shell content placed at a predictable path in a world-writable temporary directory, which the installation step reads after elevating its own privileges. To remediate this issue, users should upgrade to version 2.3.4.

CVE-2026-85028 affects the AWS FPGA Development Kit (aws-fpga) before version 2.3.4. The vulnerability exists in the FPGA management tool installation component, which creates temporary files in a directory with insecure permissions. Local users can exploit this by placing crafted shell content at a predictable path in a world-writable temporary directory. When the installation process elevates its privileges, it reads the attacker-controlled file, enabling arbitrary code execution with root privileges. This is a classic symlink/temp file race condition (TOCTOU) type vulnerability. The attack requires local access to the system. Remediation requires upgrading to aws-fpga version 2.3.4. AWS has published a security bulletin and a GitHub advisory addressing this issue.