Nix and Lix contain a signed integer overflow that leads to an out-of-bounds write when untrusted expressions are evaluated, compromising process memory integrity and potentially enabling arbitrary code execution.

Affected releases are Nix prior to 2.35.3 and Lix prior to 2.95.4, distributed by NixOS and used where external configuration or package definitions may contain untrusted expressions.

The CVSS score of 7.5 reflects a high severity, while the EPSS score of less than 1% indicates low current exploitation probability and the vulnerability is not yet in the CISA KEV catalog. The likely attack vector is the evaluation of unsolicited or malicious expressions during build or configuration, which may be remote if the system accepts external inputs or local if an attacker can influence the package data.