CVE-2026-110449 in Lix
Summary
by MITRE • 10/15/2026
Nix before 2.35.3 and Lix before 2.95.4 have an integer overflow and resultant out-of-bounds write when evaluating untrusted expressions because list allocation is mishandled.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 10/15/2026
The vulnerability identified in Nix prior to version 2.35.3 and Lix prior to version 2.95.4 represents a critical memory safety issue rooted in improper handling of integer arithmetic during the evaluation phase of untrusted expressions. This flaw specifically manifests as an integer overflow that leads directly to an out-of-bounds write operation within the software's internal data structures. The core mechanism involves the allocation of lists, where the system fails to correctly validate or clamp input values before calculating memory requirements. When a malicious actor provides crafted inputs containing excessively large integers for list sizes or indices, the arithmetic operations used to determine buffer dimensions wrap around due to fixed-width integer limitations. This results in a significantly smaller allocated buffer than what is subsequently accessed by the program logic during evaluation.
From a technical perspective, this vulnerability aligns with Common Weakness Enumeration (CWE) identifiers such as CWE-190 Integer Overflow or Wraparound and CWE-787 Out-of-bounds Write. The sequence of exploitation begins when an untrusted Nix expression is submitted to the evaluator. As the interpreter processes list literals or operations involving dynamic array sizing, it computes the necessary memory footprint based on user-supplied parameters. Due to the lack of rigorous bounds checking prior to allocation, a large integer value overflows into a small positive number. The system then allocates a buffer corresponding to this truncated size. However, subsequent write operations proceed assuming the original, larger logical size, causing data to be written beyond the allocated memory boundaries. This out-of-bounds write can corrupt adjacent heap metadata or overwrite critical program state variables, leading to undefined behavior that is difficult to predict and mitigate through standard error handling routines.
The operational impact of this vulnerability extends far beyond simple application crashes. While a denial of service resulting from segmentation faults is a likely outcome, the primary concern lies in the potential for arbitrary code execution. By carefully crafting the payload, an attacker can leverage the out-of-bounds write to overwrite function pointers, return addresses, or other control flow data structures within the heap. This capability allows for remote code execution if the Nix daemon or evaluator is running with elevated privileges, which is common in continuous integration pipelines and development environments that rely on automated builds from untrusted sources. Furthermore, this flaw undermines the integrity of package management operations, as a compromised build process can inject malicious binaries into downstream systems without detection.
In terms of threat modeling, this vulnerability maps to MITRE ATT&CK techniques related to memory corruption exploitation and potentially privilege escalation if the service account is privileged. The attack vector typically involves supplying malformed Nix expressions through API endpoints or configuration files that are processed by the evaluator. To mitigate this risk, organizations must immediately upgrade to patched versions of Nix (2.35.3 or later) and Lix (2.95.4 or later). These updates include rigorous validation checks for integer sizes before memory allocation occurs, ensuring that any value exceeding safe limits triggers an error rather than proceeding with flawed arithmetic. Additionally, developers should implement strict input sanitization policies for all external inputs feeding into the evaluation engine. Employing static analysis tools and fuzz testing during development cycles can help identify similar logic errors in other components of the software stack before they reach production environments.