Uncontrolled Recursion in nix - CVE-2026-44028
Published: May 4, 2026 / Updated: September 14, 2026
Vulnerability identifier: #VU129558
CSH Severity: Low
CVSS v4: 7.2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-44028
CWE-ID: CWE-674
Exploitation vector: Local access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a local user to execute arbitrary code.
The vulnerability exists due to uncontrolled recursion in the NAR directory parser when parsing a crafted NAR archive on a coroutine stack. A local user can supply a specially crafted NAR archive to execute arbitrary code.
Exploitation is possible for users able to connect to the Nix daemon, and successful exploitation may run code as the Nix daemon in multi-user installations if ASLR hardening is bypassed.
Affected software
nix
Fedora
nix
Fedora
nix
How to mitigate CVE-2026-44028
Install security update from vendor's website.
nix - addressed in versions 2.29.0, 2.30.0, 2.31.0, 2.32.0, 2.33.0, 2.33.6, 2.34.7
nix - update to 2.31.5-1.el10_2
nix - update to 2.31.5-1.el10_2