#1151197 nix: CVE-2026-110449 CVE-2026-110450 CVE-2026-110452

Package:
src:nix
Source:
src:nix
Submitter:
Salvatore Bonaccorso
Date:
2026-10-18 05:57:02 UTC
Severity:
normal
Tags:
#1151197#5
Date:
2026-10-18 05:55:06 UTC
From:
To:
Hi,

The following vulnerabilities were published for nix.

CVE-2026-110449[0]:
| Nix before 2.35.3 and Lix before 2.95.4 have an integer overflow and
| resultant out-of-bounds write when evaluating untrusted expressions
| because list allocation is mishandled.


CVE-2026-110450[1]:
| Nix before 2.35.3 and Lix before 2.95.4 allow privilege escalation
| via a repair operation because it could destroy and then replace a
| store path before content verification.


CVE-2026-110452[2]:
| The multi-user installer in Nix before 2.35.3 sets the ownership of
| store contents to the user (who invoked the installer) even though
| it should be root ownership.


If you fix the vulnerabilities please also make sure to include the
CVE (Common Vulnerabilities & Exposures) ids in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2026-110449
https://www.cve.org/CVERecord?id=CVE-2026-110449
[1] https://security-tracker.debian.org/tracker/CVE-2026-110450
https://www.cve.org/CVERecord?id=CVE-2026-110450
[2] https://security-tracker.debian.org/tracker/CVE-2026-110452
https://www.cve.org/CVERecord?id=CVE-2026-110452

Please adjust the affected versions in the BTS as needed.

Regards,
Salvatore