Lix Daemon Integer Overflow Vulnerability (CVE-2026-44028) Analysis and POC

Vulnerability Summary: Lix Integer Overflow Vulnerability (CVE-2026-44028) Vulnerability Overview Vulnerability Type: Integer Overflow CVE ID: CVE-2026-44028 Release Date: May 5, 2026 Severity: CVSS 3.1 Base Score 6.3 (Medium), Impact Score 5.2, Exploitability Score 1.0. Technical Details: The vulnerability exists in the Lix daemon when processing untrusted user input, specifically the NAR serialization format. An attacker can trigger an integer overflow by constructing a specially crafted NAR archive member with a length field set to $2^{64} - 8$. This results in an incorrect buffer size calculation (becoming 0), leading to an Out-of-bounds write. Exploitation is difficult in dynamically built Nixpkgs environments (requiring ASLR bypass); however, in statically built NixOS/musl environments, exploitation is immediate due to the lack of static PIE. Scope of Impact Affected Versions: Lix 2.93, 2.94, 2.95. Affected Users: All systems allowing local attackers to connect to the Lix daemon (via or configuration). Systems using Nixpkgs for dynamic builds. Systems using NixOS or musl for static builds (high risk). Prerequisites: The attacker must have local access, and the system's ASLR defenses must be weak or bypassable. Remediation Fixed Versions: Lix ≥ 2.93.4, ≥ 2.94.2, ≥ 2.95.2. Upgrade Recommendations: NixOS Users: Upgrade the Lix pin and rebuild Lix. It is recommended to use the for a HEAD build or obtain the release build from Nixpkgs. Non-NixOS Linux Users: Using the Lix installer: Run or execute the official upgrade script provided. Using package managers: Contact the distribution security team, as Lix is maintained by the community in most distributions. macOS Users: Using the Lix installer: Run or execute the official upgrade script provided. Using nix-darwin: Apply the fix from the Nixpkgs section above. * Using package managers: Contact the distribution security team. POC / Exploitation Code The page provides POC commands for testing the vulnerability: If the Lix daemon crashes, the system is vulnerable.

Goal Reached Thanks to every supporter — we hit 100%!

Lix Daemon Integer Overflow Vulnerability (CVE-2026-44028) Analysis and POC