CVE-2025-46416 json
The Nix, Lix, and Guix package managers allow a bypass of build isolation in which a user can elevate their privileges to the build user ac…
published 2025-06-27 16 mo ago modified 2026-06-17 4 mo ago also EUVD-2025-19410
- cvss
- 2.9
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.2%
- EPSS 0.2% chance of exploitation in 30 days, percentile 8%
- public exploits
- 0
- none known
Summary
The Nix, Lix, and Guix package managers allow a bypass of build isolation in which a user can elevate their privileges to the build user account (e.g., nixbld or guixbuild). This affects Nix through 2.24.15, 2.26.4, 2.28.4, and 2.29.1; Lix through 2.91.2, 2.92.2, and 2.93.1; and Guix before 1.4.0-38.0e79d5b.
Patch / fix
- gnu guix 1.4.0-38.0e79d5b
CISA SSVC
- Exploitation
- none
- Automatable
- no
- Technical impact
- partial
- Assessed
- 16 mo ago
Exploit prediction
0.18% chance of exploitation in the next 30 days, higher than 8% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 2.9 | CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N |
Affected products
- NixOS Nix
Classification
- Weakness
-
- CWE-282 Improper Ownership Management
References
- discourse.nixos.org /t/security-advisory-privilege-escalations-in-nix-lix-and-guix/66017
- lix.systems /blog/2025-06-24-lix-cves/
- guix.gnu.org /en/blog/2025/privilege-escalation-vulnerabilities-2025/
- labs.snyk.io
- security.snyk.io /vuln/?search=CVE-2025-46416
- security-tracker.debian.org /tracker/CVE-2025-46416
Sources
- CVE List CVE-2025-46416
- NVD CVE-2025-46416
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.
CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.