CVE-2026-110449

Deferred Deferred - Pending Action

Integer Overflow Leading to Out-of-Bounds Write in Nix and Lix

Publication date: 2026-10-14

Last updated on: 2026-10-16

Assigner: MITRE

Description

Nix before 2.35.3 and Lix before 2.95.4 have an integer overflow and resultant out-of-bounds write when evaluating untrusted expressions because list allocation is mishandled.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-14

Last Modified

2026-10-16

Generated

2026-10-19

AI Q&A

2026-10-14

EPSS Evaluated

2026-10-18

NVD

CVE-2026-110449

EUVD

EUVD-2026-100802

Affected Vendors & Products

Vendor	Product	Version / Range
NixOS	Nix	0
NixOS	Nix	2.29.0
NixOS	Nix	2.31.0
NixOS	Nix	2.32.0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-190	The product performs a calculation that can produce an integer overflow or wraparound when the logic assumes that the resulting value will always be larger than the original value. This occurs when an integer value is incremented to a value that is too large to store in the associated representation. When this occurs, the value may become a very small or negative number.

Attack-Flow Graph

Executive Summary

CVE-2026-110449 is an integer overflow vulnerability in Nix and Lix software that leads to an out-of-bounds write during evaluation of untrusted expressions. This occurs due to mishandling of list allocation, potentially allowing attackers to manipulate memory and execute arbitrary code.

Detection Guidance

Detecting this vulnerability requires checking the installed version of Nix or Lix. Run 'nix --version' or 'lix --version' to compare against patched versions (Nix 2.35.3+, Lix 2.95.4+). Inspect system logs for unusual store path modifications or sandbox escapes, particularly on macOS.

Impact Analysis

This vulnerability can allow attackers to escalate privileges to root, replace legitimate store paths, or escape sandbox restrictions, particularly on macOS. Systems building untrusted derivations are at risk, with effects varying by compiler optimizations and configurations.

Compliance Impact

The vulnerability could lead to unauthorized code execution or privilege escalation, potentially compromising data integrity and confidentiality. This may violate GDPR's data protection requirements or HIPAA's security rules if exploited in systems handling sensitive personal or health data.

Mitigation Strategies

Upgrade Nix to 2.35.3 or later, or Lix to 2.95.4 or later using the provided upgrade scripts. Verify store ownership and repair paths if affected. Disable untrusted derivations until patched. Check macOS sandbox profiles for proper configuration.

Hi! I’m here to help you understand CVE-2026-110449. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70