CVE-2026-110449
HighCVSS 7.5Summary
Nix before 2.35.3 and Lix before 2.95.4 have an integer overflow and resultant out-of-bounds write when evaluating untrusted expressions because list allocation is mishandled. This can lead to memory corruption and potential code execution.
Risk Assessment
An attacker can supply a malicious expression that causes memory corruption, potentially leading to arbitrary code execution or system crash. The risk is high because it involves evaluating untrusted input.
Recommendation
Update Nix to version 2.35.3 or later and Lix to version 2.95.4 or later. Avoid evaluating untrusted expressions until the update is applied.
Other vulnerabilities in Nix
See all- CVE-2026-110453Medium
Nix before 2.35.3, when unsandboxed on macOS or FreeBSD, incorrectly allows connections made by build users from daemon clients.
- CVE-2026-110452Medium
The multi-user installer in Nix before 2.35.3 sets the ownership of store contents to the user who invoked the installer, even though it should be root ownership.
- CVE-2026-110451Medium
Nix before 2.35.3 and Lix before 2.95.4 on macOS allow a Seatbelt sandbox escape (for an unconfined build) because a certain size threshold is mishandled.
- CVE-2026-110450High
Nix before 2.35.3 and Lix before 2.95.4 allow privilege escalation via a repair operation that could destroy and then replace a store path before content verification.
- CVE-2026-39860Critical
A bug in the fix for CVE-2024-27297 in Nix allows arbitrary overwrites of files writable by the Nix process by following symlinks during fixed-output derivation output registration. This affects sandboxed Linux builds only.
- CVE-2026-64846Low
Nix is a package manager for Linux and other Unix systems. Prior to 2.35.0, a malicious derivation executed with the recursive-nix experimental feature can exploit a time-of-check/time-of-use race involving final symlink handling in the LocalStore restore path. The race can cause writeFile to follow a substituted final symlink when opening a path with O_TRUNC instead of enforcing FinalSymlink::DontFollow, allowing the Nix process or nix-daemon to create or truncate an empty file outside the build sandbox with the daemon user's permissions. The primitive does not provide arbitrary-content writes and requires winning the race. This issue is fixed in version 2.35.0.
Original NVD description (English source)
Nix before 2.35.3 and Lix before 2.95.4 have an integer overflow and resultant out-of-bounds write when evaluating untrusted expressions because list allocation is mishandled.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS