CVE-2026-110449: Integer Overflow
Nix before 2.35.3 and Lix before 2.95.4 have an integer overflow and resultant out-of-bounds write when evaluating untrusted expressions because list allocation is mishandled.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this vulnerability?
Systems running Nix before 2.35.3 or Lix before 2.95.4 are exposed when they evaluate untrusted expressions.
What does an attacker need to exploit it?
An attacker needs to cause a vulnerable Nix or Lix installation to evaluate a crafted untrusted expression. No privileges or user interaction are required according to the provided vector, but exploitation has high attack complexity.
What is the impact of successful exploitation?
Successful exploitation can produce an out-of-bounds write caused by an integer overflow during list allocation. The reported impact includes high integrity impact, low availability impact, and no confidentiality impact.
How can I remediate the issue?
Upgrade Nix to 2.35.3 or later, or upgrade Lix to 2.95.4 or later. Until upgraded, avoid evaluating untrusted expressions on affected installations.