CVE-2026-44028 Details
Description
An issue was discovered in Nix before 2.34.7 and Lix before 2.95.2. Unbounded recursion in the NAR (Nix Archive) parser could lead to a stack-to-heap overflow when the parser is run on a coroutine stack. The stack is allocated without a guard page, which means that a stack overflow could overwrite memory on the heap and could allow arbitrary code execution as the Nix daemon (run as root in multi-user installations) if ASLR hardening is bypassed. This can be exploited by all users able to connect to the daemon (e.g., in Nix, this is configurable via the allowed-users setting, defaulting to all users). The fixed versions are 2.34.7, 2.33.6, 2.32.8, 2.31.5, 2.30.5, 2.29.4, and 2.28.7 for Nix (introduced in 2.24.4); and 2.95.2, 2.94.2, and 2.93.4 for Lix (introduced in 2.93.0).
A stack-to-heap overflow vulnerability has been identified in Nix versions prior to 2.34.7 and Lix versions prior to 2.95.2. The issue arises from unbounded recursion in the NAR (Nix Archive) parser, which can lead to a stack overflow that overwrites heap memory. This vulnerability can be exploited to execute arbitrary code as the Nix daemon, which runs as root in multi-user installations, if certain conditions are met. The vulnerability affects all users who can connect to the Nix daemon, with the default configuration allowing all users.
Users are advised to upgrade to Nix versions 2.34.7, 2.33.6, 2.32.8, 2.31.5, 2.30.5, 2.29.4, or 2.28.7, and to Lix versions 2.95.2, 2.94.2, or 2.93.4.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed May 5, 2026CISA-ADP
Assessed May 5, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://discourse.nixos.org/t/security-advisory-local-privilege-escalation-in-lix-and-nix/77407 | [email protected] | AdvisoryMailing ListRemedyVendor |
| https://github.com/NixOS/nix/security/advisories/GHSA-vh5x-56v6-4368 | [email protected] | AdvisoryRemedyVendor |
| https://lix.systems/blog/2026-05-05-lix-unsigned-integer-overflow/ | [email protected] | |
| https://www.openwall.com/lists/oss-security/2026/05/04/32 | [email protected] | AdvisoryMailing List |
| https://www.openwall.com/lists/oss-security/2026/05/04/33 | [email protected] | AdvisoryBundleMailing ListRemedy |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-674 | Uncontrolled Recursion | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Nix | >= 2.24.4 (semver) |
CPE
Remediation
| |
| Lix | >= 2.93.0 (semver) |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| May 9, 2026 | CVE Modified | [email protected] |
| May 5, 2026 | New CVE Received | [email protected] |