What is CVE-2025-52992?

CVE-2025-52992 is a low-severity vulnerability in Nixos Nix, classified under Incorrect Permission Assignment for Critical Resource. CVSS score: 3.2/10. Published 2025-06-27.

How severe is CVE-2025-52992?

Low severity. CVSS v3 base score is 3.2 out of 10.

Vulnerability in Nixos Nix

CVE-2025-52992

The Nix, Lix, and Guix package managers fail to properly set permissions when a derivation build fails. This may allow arbitrary processes to modify the content of a store outside of the build sandbox. This affects Nix before 2.24.15, 2.26…

EPSS: 0.001 (21.5th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 3.2 (Low). Vector: CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:N/I:L/A:N.

Affected products

Nixos Nix — versions 0, 2.25.0, 2.27.0

Weakness classification (CWE)

CWE-732 — Incorrect Permission Assignment for Critical Resource

References

discourse.nixos.org/t/security-advisory-privilege-escalations-in-nix-lix-and-gu…
lix.systems/blog/2025-06-24-lix-cves/
guix.gnu.org/en/blog/2025/privilege-escalation-vulnerabilities-2025/
labs.snyk.io
security.snyk.io/vuln/
security-tracker.debian.org/tracker/CVE-2025-52992

Frequently asked questions

What is CVE-2025-52992?: CVE-2025-52992 is a low-severity vulnerability in Nixos Nix, classified under Incorrect Permission Assignment for Critical Resource. CVSS score: 3.2/10. Published 2025-06-27.
How severe is CVE-2025-52992?: Low severity. CVSS v3 base score is 3.2 out of 10.