vulntracker.iovulntracker.io
© 2026 vulntracker.io

CVE-2025-46416

LOW
2.9
CVSS Score
Published: June 27, 2025 at 12:00 AM UTC
Updated: June 17, 2026 at 09:26 AM UTC
1 product affected across 1 vendorNix

Using Nix by NixOS?

Get instant alerts when new vulnerabilities affect Nix - before attackers find them.

Real-time alertsTrack your software stackFree plan available
Start FreeSign In
Severity
LOW2.9
Exploit prediction
EPSS 0.2%
SSVC
No known exploit

Description

The Nix, Lix, and Guix package managers allow a bypass of build isolation in which a user can elevate their privileges to the build user account (e.g., nixbld or guixbuild). This affects Nix through 2.24.15, 2.26.4, 2.28.4, and 2.29.1; Lix through 2.91.2, 2.92.2, and 2.93.1; and Guix before 1.4.0-38.0e79d5b.

Affected

Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.

Nix· Nixos
95%
v ≤ 2.24.152.25.0 ≤ v ≤ 2.26.42.27.0 ≤ v ≤ 2.28.42.29.0 ≤ v ≤ 2.29.12.25.02.27.02.29.0

Remediation

No guide yet

No remediation guidance has been written for this CVE yet, and no fixed version or vendor advisory is recorded against it.

References (6)

Source: [email protected]
https://discourse.nixos.org/t/security-advisory-privilege-escalations-in-nix-lix-and-guix/66017
Source: [email protected]
https://guix.gnu.org/en/blog/2025/privilege-escalation-vulnerabilities-2025/
Source: [email protected]
https://labs.snyk.io
Source: [email protected]
https://lix.systems/blog/2025-06-24-lix-cves/
Source: [email protected]
https://security-tracker.debian.org/tracker/CVE-2025-46416
Source: [email protected]
https://security.snyk.io/vuln/?search=CVE-2025-46416

SSVC — Action Prioritization

SSVCNo known exploitNot automatablePartial impact

SSVC signals action urgency (what to patch first), separate from CVSS which measures severity.

CVSS

2.9LOWmitre
Vector?

Quick Info

StatusDEFERRED
CWE
CWE-282

Get alerted

Stop reading CVE feeds looking for your own stack

Track the products you run and VulnTracker tells you when a new CVE affects them — with what is known about fixing it, and nothing about the rest.

Create accountSign in
Free plan, no card