CVE-2026-64846

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-64846
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-64846.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-64846
Aliases
  • GHSA-6h4g-g5j9-fm5f
Downstream
Published
2026-08-20T16:18:06.729Z
Modified
2026-08-22T09:15:58.301082Z
Severity
  • 2.8 (Low) CVSS_V3 - CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:N/I:L/A:N CVSS Calculator
Summary
Nix: Arbitrary file truncation outside the sandbox with recursive-nix experimental feature
Details

Nix is a package manager for Linux and other Unix systems. Prior to 2.35.0, a malicious derivation executed with the recursive-nix experimental feature can exploit a time-of-check/time-of-use race involving final symlink handling in the LocalStore restore path. The race can cause writeFile to follow a substituted final symlink when opening a path with O_TRUNC instead of enforcing FinalSymlink::DontFollow, allowing the Nix process or nix-daemon to create or truncate an empty file outside the build sandbox with the daemon user's permissions. The primitive does not provide arbitrary-content writes and requires winning the race. This issue is fixed in version 2.35.0.

Database specific 
{
    "cwe_ids": [
        "CWE-367",
        "CWE-61"
    ],
    "cna_assigner": "GitHub_M",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/64xxx/CVE-2026-64846.json"
}
References

Affected packages

Git / github.com/nixos/nix

Affected ranges

Type
GIT
Repo
https://github.com/nixos/nix
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
26679828f74ee6e82a4100904e6361f993ff5390
Database specific
Show details 
{
    "source": [
        "AFFECTED_FIELD",
        "REFERENCES"
    ],
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "2.35.0"
        }
    ]
}

Affected versions

1.*
1.0
1.1
1.10
1.11
1.11.1
1.2
1.3
1.4
1.5
1.5.1
1.5.2
1.5.3
1.6
1.6.1
1.7
1.8
1.9
2.*
2.0
2.2

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-64846.json"
vanir_signatures 
[
    {
        "signature_type": "Line",
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "261979631496515240248091455680768272313",
                "337684205262061194091550388858098463224",
                "175336703321281864924138511037861303941",
                "204873868654664549407135874780977676669"
            ]
        },
        "target": {
            "file": "src/libutil/file-content-address.cc"
        },
        "source": "https://github.com/nixos/nix/commit/26679828f74ee6e82a4100904e6361f993ff5390",
        "signature_version": "v1",
        "id": "CVE-2026-64846-10508b31",
        "deprecated": false
    },
    {
        "signature_type": "Function",
        "digest": {
            "function_hash": "200093320886713666658772408323425904950",
            "length": 283.0
        },
        "target": {
            "function": "restorePath",
            "file": "src/libutil/file-content-address.cc"
        },
        "source": "https://github.com/nixos/nix/commit/26679828f74ee6e82a4100904e6361f993ff5390",
        "signature_version": "v1",
        "id": "CVE-2026-64846-5796f6c8",
        "deprecated": false
    },
    {
        "signature_type": "Line",
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "173738584817477232377379188695496152279",
                "210173992075291704696796629754366998363",
                "89193794086563001525686165590918125239",
                "177344224614619445062012904981437863625",
                "197431063365938691274197682413401278871"
            ]
        },
        "target": {
            "file": "src/libutil/include/nix/util/file-system.hh"
        },
        "source": "https://github.com/nixos/nix/commit/26679828f74ee6e82a4100904e6361f993ff5390",
        "signature_version": "v1",
        "id": "CVE-2026-64846-7797733f",
        "deprecated": false
    },
    {
        "signature_type": "Line",
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "181433945287688630887079180450237822480",
                "298768339959756682046668857855529876019",
                "199913190282373090463987298379080102386",
                "223982893473382833425433455567421244497",
                "301554380220323015514189563845575395728",
                "37698757318052831710539673055272207948",
                "327858329302783577538962900164136398853",
                "48763889986751110118470305394524384024",
                "211778956030963276645783390381935941030",
                "319128749599322447418255390817269565455",
                "82149067837396961012261524849591608315",
                "28225169153634510548732115067309804265",
                "171623742820104426674277692888705431779",
                "322741862754296487941477772910968378530",
                "199108554311106513930857924110721111921",
                "301554380220323015514189563845575395728",
                "37698757318052831710539673055272207948",
                "327858329302783577538962900164136398853",
                "48763889986751110118470305394524384024",
                "211778956030963276645783390381935941030",
                "319128749599322447418255390817269565455",
                "82149067837396961012261524849591608315"
            ]
        },
        "target": {
            "file": "src/libutil/file-system.cc"
        },
        "source": "https://github.com/nixos/nix/commit/26679828f74ee6e82a4100904e6361f993ff5390",
        "signature_version": "v1",
        "id": "CVE-2026-64846-96d7cd4b",
        "deprecated": false
    },
    {
        "signature_type": "Function",
        "digest": {
            "function_hash": "307339821807366702887062680923383416549",
            "length": 354.0
        },
        "target": {
            "function": "writeFile",
            "file": "src/libutil/file-system.cc"
        },
        "source": "https://github.com/nixos/nix/commit/26679828f74ee6e82a4100904e6361f993ff5390",
        "signature_version": "v1",
        "id": "CVE-2026-64846-9d1bb5d7",
        "deprecated": false
    },
    {
        "signature_type": "Function",
        "digest": {
            "function_hash": "251257566064089742692957332902399737336",
            "length": 718.0
        },
        "target": {
            "function": "writeFile",
            "file": "src/libutil/file-system.cc"
        },
        "source": "https://github.com/nixos/nix/commit/26679828f74ee6e82a4100904e6361f993ff5390",
        "signature_version": "v1",
        "id": "CVE-2026-64846-d1885df2",
        "deprecated": false
    }
]
vanir_signatures_modified 
"2026-08-22T09:15:58Z"