SB2026101537 - Multiple vulnerabilities in nix

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2026101537

SB2026101537 - Multiple vulnerabilities in nix

Published: October 15, 2026

Security Bulletin ID SB2026101537
CSH Severity
Medium
Patch available
YES
Number of vulnerabilities 5
Exploitation vector Local access
Highest impact Data manipulation

Breakdown by Severity

Medium 20% Low 80%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 5 vulnerabilities.


1) Incorrect authorization (CVE-ID: CVE-2026-110451)

CWE-ID: CWE-863 - Incorrect Authorization

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a local user to read arbitrary files on the host filesystem.

The vulnerability exists due to a logic error in the seatbelt sandbox policy generation component when splitting policies into chunks for sandboxed macOS derivation builds. A local user can supply a malicious derivation that bypasses the intended filesystem restrictions to read arbitrary files on the host filesystem.

Exploitation requires the Nix sandbox to be enabled, which is not the default configuration.


2) Incorrect Ownership Assignment (CVE-ID: CVE-2026-110452)

CWE-ID: CWE-708 - Incorrect Ownership Assignment

CVSSv4: 7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a local privileged user to execute arbitrary code as root.

The vulnerability exists due to incorrect ownership assignment in the multi-user bootstrap installer when installation is initiated by an unprivileged user. A local privileged user can replace the nix binary or its dependencies left under the invoking user's ownership in the store to execute arbitrary code as root when the init system launches nix.

Users included in the trusted-users list already have the ability to delete and replace arbitrary store objects.


3) Incorrect authorization (CVE-ID: CVE-2026-110453)

CWE-ID: CWE-863 - Incorrect Authorization

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a local user to bypass connection restrictions on the Nix daemon.

The vulnerability exists due to incorrect authorization caused by ignoring the effective group ID in the Nix daemon when retrieving peer credentials through the LOCAL_PEERCRED socket option. A local user can connect from an unsandboxed derivation builder belonging to the build-users-group to bypass connection restrictions on the Nix daemon.

The issue occurs on BSD-based systems, including macOS and FreeBSD. Linux uses SO_PEERCRED and is not affected. This exposure can exacerbate separate vulnerabilities in the daemon.


4) Improper Authorization (CVE-ID: CVE-2026-110450)

CWE-ID: CWE-285 - Improper Authorization

CVSSv4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a local user to corrupt arbitrary store objects and escalate privileges.

The vulnerability exists due to improper authorization in the nix-daemon AddToStoreNar and AddMultipleToStore operations when processing client-supplied NAR contents in repair mode. A local user can submit crafted NAR contents with the repair flag enabled to corrupt arbitrary store objects and escalate privileges.

Exploitation is available to users matched by allowed-users even when they are not listed in trusted-users. Privilege escalation requires a privileged service to execute files from a corrupted store object; in multi-user configurations, the Nix daemon itself can provide this execution path when running as root.


5) Integer overflow (CVE-ID: CVE-2026-110449)

CWE-ID: CWE-190 - Integer overflow

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to corrupt heap memory.

The vulnerability exists due to unsigned integer overflow in the list size calculation of libexpr's builtins.genList when evaluating expressions with large list-size arguments. A remote attacker can supply large arguments that cause a mismatch between the allocated list size and the expected list size to corrupt heap memory.

The possibility of out-of-bounds writes depends on the Nix version and compiler optimizations. Out-of-bounds reads can be triggered reliably.


Remediation

Install update from vendor's website.

References