Uncontrolled Recursion in nix - #VU129558
Published: May 4, 2026
Vulnerability identifier: #VU129558
CSH Severity: Low
CVSS v4.0: CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear
CVE-ID: N/A
CWE-ID: CWE-674
Exploitation vector: Local access
Exploit availability:
No public exploit available
Vendor: nixos.org
Affected software:
nix
nix
Detailed vulnerability description
The vulnerability allows a local user to execute arbitrary code.
The vulnerability exists due to uncontrolled recursion in the NAR directory parser when parsing a crafted NAR archive on a coroutine stack. A local user can supply a specially crafted NAR archive to execute arbitrary code.
Exploitation is possible for users able to connect to the Nix daemon, and successful exploitation may run code as the Nix daemon in multi-user installations if ASLR hardening is bypassed.
Remediation
Install security update from vendor's website.