Nix CVE-2026-110452

Applies only to systems installed via the Nix multi-user installer in versions before 2.35.3, where the installer wrongly set /nix/store ownership to the invoking user instead of root. Exploitation requires local access to the account that owns the store (or any account with write access to the mis-owned store paths); there is no remote or network-reachable path despite the input vector listing PR:N. Limiting factors: the vector is local (AV:L), the host must have been provisioned with the affected multi-user installer rather than re-owned or single-user, and the attacker must already hold a local account on the machine. Single-admin workstations where the installing user is already the privileged operator see little practical privilege boundary crossed.

The provided CVSS 3.1 base score is 4.0 (Medium) with vector AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N - a local attack vector, low complexity, and integrity-only impact. There is a notable internal conflict: the vector states PR:N (no privileges), yet the flaw concerns ownership of /nix/store being assigned to a local user account, which inherently implies the attacker is a local user - verify authentication assumptions with the vendor, as PR:L is more defensible than PR:N here. No EPSS score was provided in the input, so exploitation-probability cannot be quantified; this is a data gap, not a low-risk signal. The CVE is not listed in CISA KEV and no POC/exploit code is referenced, so exploitation status is 'no public exploit identified at time of analysis.' Functionally this is a local privilege-escalation primitive (incorrect ownership, CWE-708): store paths that should be root-owned are writable by a non-root user, so the vendor's I:L/C:N/A:N scoring is arguably conservative given that tampering with store binaries later executed by root can yield fuller compromise. Net: this is not an internet-facing, mass-exploitable emergency - the local-only vector and absence of KEV/POC/EPSS keep real-world urgency moderate - but it warrants prompt patching on any multi-user Nix host installed with the affected installer because of the latent privilege-escalation potential.

On a multi-user Nix/NixOS host installed with the vulnerable installer (Nix before 2.35.3), /nix/store contents are owned by the user who ran the installer rather than root. That local user can modify or replace a store path; when root or another user later executes the tampered binary, the attacker's code runs with elevated privileges. No public exploit code is referenced, and exploitation requires local access to the affected account.