A stack-to-heap overflow vulnerability in Nix and Lix allows local users with daemon access to execute arbitrary code with root privileges.

This flaw involves uncontrolled recursion in the NAR parser leading to a stack-to-heap overflow, requiring low privileges and local access by an authenticated user.

A successful exploit allows a local attacker to compromise the host operating system entirely by executing arbitrary code as the root-level Nix daemon. This undermines multi-tenant isolation on systems running shared build agents or developer environments. The CVSS score of 7.5 reflects the severity of total technical impact despite requiring local access and high attack complexity.

Immediate Action: Update Nix to version 2.34.7, 2.33.6, 2.32.8, 2.31.5, 2.30.5, 2.29.4, or 2.28.7, and Lix to version 2.95.2, 2.94.2, or 2.93.4 depending on your active branch.

Proactive Monitoring: Audit local user accounts on multi-user installations and review system authorization logs for unusual process execution patterns spawned by the Nix daemon.

Compensating Controls: Restrict access to the Nix daemon using the allowed-users configuration setting to limit which local accounts can communicate with the service.

Public Exploit Available: No (false / unknown)

Administrators managing multi-user Nix or Lix installations must prioritize applying the available vendor security updates immediately. Because this vulnerability permits full root privilege escalation from a low-privileged local context, prompt patching is essential to secure the underlying host environment.