Nix CVE-2026-110449

Exploitation requires the target to evaluate an attacker-controlled (untrusted) Nix expression that triggers the mishandled list allocation - e.g., a Hydra or CI evaluator processing externally submitted expressions, a multi-user Nix daemon evaluating untrusted code, or any service that accepts and evaluates third-party Nix input. The primary limiting factor is that standard single-user workflows evaluate only trusted, self-authored expressions and are therefore not exposed via a network vector; additionally, the high attack complexity (AC:H) means the attacker must precisely craft allocation sizes to drive the integer overflow, and only Nix before 2.35.3 and Lix before 2.95.4 are vulnerable.

The input CVSS of 7.5 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:H/A:L) describes a network-reachable but high-complexity flaw requiring no privileges or user interaction, with a scope change and high integrity impact but no confidentiality and only low availability impact - consistent with a memory-corruption (integer overflow → out-of-bounds write, CWE-190) primitive rather than a trivial crash. No EPSS score, CISA KEV listing, or public POC was provided, so there is no public exploit identified at time of analysis and no evidence of active exploitation; the AC:H rating and the need to specifically trigger a mishandled list allocation suggest exploitation is non-trivial and not yet commoditized. The most important caveat is the attack vector: CVSS marks this AV:N, but the description's precondition is 'evaluating untrusted expressions,' which only maps to a network vector in deployments that accept attacker-supplied Nix code (e.g., Hydra/CI evaluation of pull requests or remote build submissions) - in ordinary single-user or trusted-expression workflows the realistic vector is local, so the AV:N rating likely reflects the worst-case service scenario and should be verified against actual deployment mode. Net: a genuine but conditional high-severity issue (memory write primitive in a build/package tool), not a drop-everything internet-wide emergency, because exploitation depends on the target evaluating untrusted input and the attack complexity is high.

An attacker submits a malicious Nix expression to a system that evaluates untrusted input - for example a shared Hydra/CI evaluator processing a pull request or a multi-user build server - crafted to overflow an integer during list allocation. The resulting out-of-bounds write corrupts evaluator memory, potentially leading to code execution in the context of the evaluation process. No public exploit code is known, and the high attack complexity (AC:H) means reliable exploitation requires precise control over allocation sizes.