Vulnerability in Nixos Nix

CVE-2026-64846

Nix is a package manager for Linux and other Unix systems. Prior to 2.35.0, a malicious derivation executed with the recursive-nix experimental feature can exploit a time-of-check/time-of-use race involving final symlink handling in the LocalStore restore path. The race can cause writeFile to follow a substituted final symlink when opening a path with O_TRUNC instead of enforcing FinalSymlink::DontFollow, allowing the Nix process or nix-daemon to create or truncate an empty file outside the build sandbox with the daemon user's permissions. The primitive does not provide arbitrary-content writes and requires winning the race. This issue is fixed in version 2.35.0.

Published · last modified .

CVSS v3 metric

CVSS v3 base score 2.8 (Low). Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:N/I:L/A:N.

EPSS exploit prediction

EPSS: 0.001 (1.1th percentile), scored .

Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 1st percentile — 1.1% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.

EPSS trend (30 days)EPSS over the last 30 days for CVE-2026-64846: held from 0.001 to 0.001.

EPSS over last 30 days · oldest: 0.001 · newest: 0.001 · change: +0.000

Affected products

Weakness classification (CWE)

References

Frequently asked questions

What is CVE-2026-64846?
CVE-2026-64846 is a low-severity vulnerability in Nixos Nix, classified under UNIX Symbolic Link (Symlink) Following. CVSS score: 2.8/10. Published 2026-08-20.
How severe is CVE-2026-64846?
Low severity. CVSS v3 base score is 2.8 out of 10.