Is CVE-2026-64846 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-64846 being exploited in the wild.

How severe is CVE-2026-64846?

Low severity, with a CVSS score of 2.8, published 20 August 2026.

Is there a fix for CVE-2026-64846?

A patch was published on 2026: Fixed in version 2.35.0 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-64846 attacked?

It is attacked with local access, in an operating system.

Am I affected by CVE-2026-64846?

Check whether you run Nixos Nix at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-64846: Nix package manager time-of-check/time-of-use in symlink handling

CVE-2026-64846 · Severity: low · CVSS 2.8 · Published 2026-08-20

Nix is a package manager for Linux and Unix systems that manages software dependencies and builds. Prior to version 2.35.0, when using the recursive-nix experimental feature, a malicious software package could exploit a race condition in how Nix handles symbolic links during file operations. This could allow an attacker to create or truncate files outside the sandbox with the permissions of the Nix daemon user, potentially affecting system integrity on machines using this feature.

Technologies: Nixos Nix. Vendors: Nixos.

Quick answers

Is CVE-2026-64846 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-64846 being exploited in the wild.
How severe is CVE-2026-64846?: Low severity, with a CVSS score of 2.8, published 20 August 2026.
Which products and versions are affected?: Nixos Nix prior to 2.35.0.
Is there a fix for CVE-2026-64846?: A patch was published on 2026: Fixed in version 2.35.0 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-64846 attacked?: It is attacked with local access, in an operating system.
Am I affected by CVE-2026-64846?: Check whether you run Nixos Nix at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is a time-of-check/time-of-use (TOCTOU) race condition in the LocalStore restore path involving final symlink handling. When writeFile opens a path with O_TRUNC, it fails to enforce FinalSymlink::DontFollow, allowing a symbolic link substitution attack. The attack requires a malicious derivation running under the recursive-nix experimental feature and winning a filesystem race condition. Successful exploitation allows creation or truncation of an empty file outside the build sandbox with daemon user permissions, though arbitrary content writes are not possible. The issue is fixed in Nix 2.35.0 by exposing FinalSymlink in writeFile arguments and using O_NOFOLLOW guards in the restore path.

Affected products

NixOS Nix prior to 2.35.0

Timeline

2026-08-20: disclosed
2026: patched: Fixed in version 2.35.0

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.