# CVE-2026-110449: Nix integer overflow in list allocation

Source: https://junglewise.ai/threats/cve-2026-110449-nix-before-2-35-3-and-lix-before-2-95-4-have-an-integer-overflow  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-14. Updated: 2026-10-16  
License: CC BY 4.0 with a link back

CVE-2026-110449 · Severity: high · CVSS 7.5 · Published 2026-10-14

Nix and Lix are package managers that evaluate configuration code during system builds. An integer overflow in list allocation can cause out-of-bounds memory writes when processing untrusted Nix expressions, allowing attackers to corrupt memory and potentially execute code during builds or nix eval operations.

Technologies: [Lix](https://junglewise.ai/threats/technologies/lix-lix), [Nixos Nix](https://junglewise.ai/threats/technologies/nix). Vendors: [Lix](https://junglewise.ai/threats/vendors/lix), [Nixos](https://junglewise.ai/threats/vendors/nixos).

## Quick answers

**Is CVE-2026-110449 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-110449 being exploited in the wild.

**How severe is CVE-2026-110449?** High severity, with a CVSS score of 7.5, published 14 October 2026.

**Which products and versions are affected?** Lix before 2.95.4; also affects 2.94.x before 2.94.3; Nixos Nix before 2.35.3; also affects 2.34.x before 2.34.9, 2.31.x before 2.31.6, 2.30.x before 2.30.6, 2.28.x before 2.28.8.

**Is there a fix for CVE-2026-110449?** Yes: fixed in Nix: 2.35.3, 2.34.9, 2.31.6, 2.30.6, 2.28.8; Lix: 2.95.4, 2.94.3, 2.96.0. Until then: Restrict evaluation of untrusted Nix expressions until systems are upgraded. On macOS, the sandbox is disabled by default; verify sandbox configuration is set to false if available. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-110449 attacked?** It is attacked over the network or with local access.

**Am I affected by CVE-2026-110449?** Check whether you run Lix or Nixos Nix at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in Nix: 2.35.3, 2.34.9, 2.31.6, 2.30.6, 2.28.8; Lix: 2.95.4, 2.94.3, 2.96.0

Restrict evaluation of untrusted Nix expressions until systems are upgraded. On macOS, the sandbox is disabled by default; verify sandbox configuration is set to false if available.

## Technical details

An unsigned integer overflow occurs in the builtins.genList function when allocating Nix lists, causing a heap out-of-bounds write during evaluation of untrusted expressions. This affects any system evaluating untrusted Nix code via nix eval, builds, or other expression evaluation mechanisms. The vulnerability requires evaluation of attacker-controlled Nix code but no other preconditions.

## Affected products

- NixOS Nix before 2.35.3; also affects 2.34.x before 2.34.9, 2.31.x before 2.31.6, 2.30.x before 2.30.6, 2.28.x before 2.28.8
- Lix Lix before 2.95.4; also affects 2.94.x before 2.94.3

## Timeline

- 2026-10-13: disclosed
- 2026-10-13: patched

## References

- [https://discourse.nixos.org/t/security-advisory-for-nix-and-lix-october-2026/80547](https://discourse.nixos.org/t/security-advisory-for-nix-and-lix-october-2026/80547)

## Related threats

- [Nix daemon improper authorization of clients on macOS and FreeBSD](https://junglewise.ai/threats/cve-2026-110453-nix-before-2-35-3-when-unsandboxed-on-macos-or-freebsd)
- [Nix multi-user installer improper file ownership](https://junglewise.ai/threats/cve-2026-110452-the-multi-user-installer-in-nix-before-2-35-3-sets-the-ownership)
- [Nix Seatbelt sandbox escape on macOS](https://junglewise.ai/threats/cve-2026-110451-nix-before-2-35-3-and-lix-before-2-95-4-on-macos-allow-a)
- [Nix privilege escalation via repair operation](https://junglewise.ai/threats/cve-2026-110450-nix-before-2-35-3-and-lix-before-2-95-4-allow-privilege)
- [Nix package manager time-of-check/time-of-use in symlink handling](https://junglewise.ai/threats/cve-2026-64846-nix-package-manager-time-of-check-time-of-use-in-symlink-handling)