Integer Overflow and Out-of-Bounds Write in Nix and Lix Prior to Certain Versions

CVE-2026-110449

What is CVE-2026-110449?

Earlier versions of Nix (prior to 2.35.3) and Lix (prior to 2.95.4) are susceptible to an integer overflow vulnerability that leads to an out-of-bounds write. This issue arises when untrusted expressions are evaluated, causing improper allocation within lists. Consequently, this vulnerability can lead to significant security risks if exploited, as it may allow attackers to corrupt memory or execute arbitrary code.

References