Is CVE-2026-110449 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-110449 being exploited in the wild.

How severe is CVE-2026-110449?

High severity, with a CVSS score of 7.5, published 14 October 2026.

Which products and versions are affected?

Lix before 2.95.4; also affects 2.94.x before 2.94.3; Nixos Nix before 2.35.3; also affects 2.34.x before 2.34.9, 2.31.x before 2.31.6, 2.30.x before 2.30.6, 2.28.x before 2.28.8.

How is CVE-2026-110449 attacked?

It is attacked over the network or with local access.

Am I affected by CVE-2026-110449?

Check whether you run Lix or Nixos Nix at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-110449: Nix integer overflow in list allocation

CVE-2026-110449 · Severity: high · CVSS 7.5 · Published 2026-10-14

Nix and Lix are package managers that evaluate configuration code during system builds. An integer overflow in list allocation can cause out-of-bounds memory writes when processing untrusted Nix expressions, allowing attackers to corrupt memory and potentially execute code during builds or nix eval operations.

Technologies: Lix, Nixos Nix. Vendors: Lix, Nixos.

Quick answers

Is CVE-2026-110449 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-110449 being exploited in the wild.
How severe is CVE-2026-110449?: High severity, with a CVSS score of 7.5, published 14 October 2026.
Which products and versions are affected?: Lix before 2.95.4; also affects 2.94.x before 2.94.3; Nixos Nix before 2.35.3; also affects 2.34.x before 2.34.9, 2.31.x before 2.31.6, 2.30.x before 2.30.6, 2.28.x before 2.28.8.
Is there a fix for CVE-2026-110449?: Yes: fixed in Nix: 2.35.3, 2.34.9, 2.31.6, 2.30.6, 2.28.8; Lix: 2.95.4, 2.94.3, 2.96.0. Until then: Restrict evaluation of untrusted Nix expressions until systems are upgraded. On macOS, the sandbox is disabled by default; verify sandbox configuration is set to false if available. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-110449 attacked?: It is attacked over the network or with local access.
Am I affected by CVE-2026-110449?: Check whether you run Lix or Nixos Nix at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: Nix: 2.35.3, 2.34.9, 2.31.6, 2.30.6, 2.28.8; Lix: 2.95.4, 2.94.3, 2.96.0

Restrict evaluation of untrusted Nix expressions until systems are upgraded. On macOS, the sandbox is disabled by default; verify sandbox configuration is set to false if available.

Technical details

An unsigned integer overflow occurs in the builtins.genList function when allocating Nix lists, causing a heap out-of-bounds write during evaluation of untrusted expressions. This affects any system evaluating untrusted Nix code via nix eval, builds, or other expression evaluation mechanisms. The vulnerability requires evaluation of attacker-controlled Nix code but no other preconditions.

Affected products

NixOS Nix before 2.35.3; also affects 2.34.x before 2.34.9, 2.31.x before 2.31.6, 2.30.x before 2.30.6, 2.28.x before 2.28.8
Lix Lix before 2.95.4; also affects 2.94.x before 2.94.3

Timeline

2026-10-13: disclosed
2026-10-13: patched

References

https://discourse.nixos.org/t/security-advisory-for-nix-and-lix-october-2026/80547

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.