CVE-2026-110449

Executive Summary

CVE-2026-110449 is an integer overflow leading to an out-of-bounds write in the Nix and Lix package managers before versions 2.35.3 and 2.95.4 respectively. The flaw is triggered when evaluating untrusted expressions due to mishandled list allocation. An attacker who can supply a malicious Nix expression to a vulnerable system can potentially achieve arbitrary code execution or cause a denial of service. The CVSS score is 7.5, indicating a high-severity vulnerability, though exploitation requires a high level of access complexity.

Technical Analysis

The vulnerability resides in the expression evaluation engine of Nix and Lix. According to the NVD description, an integer overflow occurs during list allocation when processing untrusted expressions. This overflow results in an out-of-bounds write, corrupting memory. The root cause is improper handling of list allocation sizes, likely when the calculated size for a list exceeds the maximum representable integer, leading to a smaller buffer being allocated than required. The attack surface is the evaluation of Nix expressions, which can be provided via various inputs such as .nix files, command-line arguments, or remote flake references. The CVSS vector indicates network attack vector (AV:N), high attack complexity (AC:H), no privileges required (PR:N), no user interaction (UI:N), and changed scope (S:C). The confidentiality impact is none (C:N), integrity impact is high (I:H), and availability impact is low (A:L). This suggests the primary risk is memory corruption that could lead to code execution or data integrity issues, while confidentiality is not directly impacted. The CWE-190 classification confirms the integer overflow. No specific function names or code paths are provided in the description, so further detail is inferred from the vulnerability class.

Exploitation Scenarios

Exploitation of CVE-2026-110449 requires the ability to supply a crafted Nix expression to a vulnerable instance of Nix or Lix. The attack chain can be broken down as follows:

1. Reconnaissance: An attacker identifies a target system running Nix or Lix with a version below 2.35.3 or 2.95.4. This could be a CI/CD pipeline, a developer workstation, or a server that evaluates untrusted Nix expressions, such as a multi-tenant build service or a remote Nix store.

2. Triggering the flaw: The attacker crafts a malicious Nix expression that, when evaluated, causes an integer overflow during list allocation. This likely involves a list with an extremely large size or a specially crafted attribute set that manipulates the allocation size calculation. The exact construction is not detailed in the available description.

3. Payload execution: The out-of-bounds write can overwrite adjacent memory structures. Depending on the memory layout and the attacker's control over the written data, this could lead to arbitrary code execution or a crash. The high attack complexity (AC:H) suggests that reliable exploitation may require precise heap grooming or knowledge of the target environment.

4. Post-exploitation: Successful exploitation could allow the attacker to execute arbitrary code with the privileges of the Nix process. In a CI/CD context, this could lead to supply chain compromise, allowing the attacker to inject malicious code into build artifacts. Alternatively, a denial of service could be achieved by crashing the Nix daemon.

No public proof-of-concept or exploit code is available at this time. The attack chain is inferred from the vulnerability class (integer overflow leading to out-of-bounds write) and the context of Nix expression evaluation.

Impact Assessment

The impact of CVE-2026-110449 is significant for organizations that rely on Nix or Lix for package management and build automation. The CVSS score of 7.5 reflects a high-severity vulnerability. The changed scope (S:C) indicates that a successful exploit could impact resources beyond the vulnerable component, such as the host system or other containers. The high integrity impact (I:H) means that an attacker could modify data or execute arbitrary code, potentially compromising the integrity of software builds. The low availability impact (A:L) suggests that a denial of service is possible but not the primary concern. The lack of confidentiality impact (C:N) indicates that the vulnerability does not directly lead to data exposure. However, in a build environment, integrity compromise can be just as damaging, as it could allow an attacker to inject backdoors into software artifacts. Affected systems include any environment where untrusted Nix expressions are evaluated, such as public CI/CD services, shared build servers, or systems that fetch flakes from untrusted sources. The blast radius could extend to downstream users of the compromised software.

Detection Guidance

Sigma Rule

title: Nix/Lix Integer Overflow Exploitation Attempt
id: 8a9b3c4d-5e6f-7a8b-9c0d-1e2f3a4b5c6d
status: experimental
description: Detects potential exploitation of CVE-2026-110449 via crafted Nix expressions causing integer overflow.
author: Threat Intelligence
date: 2026-01-01
logsource:
  category: process_creation
  product: linux
detection:
  selection:
    Image|endswith:
      - '/nix'
      - '/nix-build'
      - '/nix-instantiate'
      - '/lix'
    CommandLine|contains:
      - '--eval'
      - '--expr'
      - '--file'
  condition: selection
falsepositives:
  - Legitimate use of Nix evaluation commands
level: medium

YARA Rule

rule CVE_2026_110449_Nix_Lix_Integer_Overflow
{
    meta:
        description = "Detects Nix/Lix binaries potentially vulnerable to CVE-2026-110449 integer overflow"
        author = "Threat Intelligence"
        date = "2026-01-01"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-110449"
        hash = "unknown"
    strings:
        $s1 = "list allocation" ascii wide nocase
        $s2 = "integer overflow" ascii wide nocase
        $s3 = "out-of-bounds write" ascii wide nocase
    condition:
        any of them
}

Suricata IDS Rule

alert tcp any any -> any any (msg:"CVE-2026-110449 Nix/Lix Integer Overflow Exploitation Attempt"; flow:to_server,established; content:"nix"; nocase; content:"eval"; nocase; distance:0; content:"list"; nocase; distance:0; content:"alloc"; nocase; distance:0; classtype:attempted-admin; sid:1000001; rev:1;)

Elastic Detection

process where process.name in ("nix", "nix-build", "nix-instantiate", "lix") and process.args : ("*--eval*", "*--expr*", "*--file*")

Splunk SPL Query

index=main sourcetype=linux_secure OR sourcetype=syslog
| search (process_name IN ("nix", "nix-build", "nix-instantiate", "lix") AND (process_args="*--eval*" OR process_args="*--expr*" OR process_args="*--file*"))
| stats count by host, process_name, process_args, user

Wazuh OSSEC Rule

<group name="nix,">
  <rule id="100001" level="10">
    <decoded_as>json</decoded_as>
    <field name="process.name">nix|nix-build|nix-instantiate|lix</field>
    <field name="process.args">--eval|--expr|--file</field>
    <description>CVE-2026-110449: Potential Nix/Lix integer overflow exploitation attempt</description>
    <mitre>
      <id>T1190</id>
    </mitre>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source).

Immediate Mitigations:

1. Avoid evaluating untrusted Nix expressions on vulnerable systems. This includes refraining from building flakes or expressions from untrusted sources.
2. Isolate Nix evaluation environments using containers or virtual machines with restricted privileges to limit the impact of a successful exploit.
3. Monitor for anomalous Nix evaluation activity, especially expressions with unusually large list sizes or suspicious constructs.
4. Apply the principle of least privilege to Nix daemon processes.

Patch/Upgrade Steps:

1. Upgrade Nix to version 2.35.3 or later.
2. Upgrade Lix to version 2.95.4 or later.
3. Verify the upgrade by checking the version with nix --version or lix --version.
4. Since no patch sources are currently tracked, monitor the official Nix and Lix repositories for updates.

Long-Term Hardening:

1. Implement input validation and sanitization for Nix expressions, especially when accepting expressions from external sources.
2. Use memory-safe languages or bounds-checking mechanisms if developing custom Nix evaluation tools.
3. Regularly update Nix and Lix to the latest versions to benefit from security fixes.
4. Conduct security audits of CI/CD pipelines that use Nix to identify and mitigate risks.

References

1. NVD - CVE-2026-110449: https://nvd.nist.gov/vuln/detail/CVE-2026-110449
2. NixOS Security Advisories: https://nixos.org/security/
3. Lix Security Advisories: https://lix.systems/security/
4. CWE-190: Integer Overflow or Wraparound: https://cwe.mitre.org/data/definitions/190.html
5. MITRE ATT&CK T1190: https://attack.mitre.org/techniques/T1190/