The multi-user installer in Nix before 2.35.3 sets the ownership of store contents to the user who invoked it instead of the intended root owner, as stated in the advisory. This is a CWE-708 flaw. This incorrect ownership assignment creates a pathway for the invoking user to gain privileges that the root account would normally enforce, potentially allowing them to modify or replace installed packages and compromise system integrity.

Affected systems are Nix installations that use the multi-user installer before version 2.35.3. The original CVE description does not enumerate specific affected releases; therefore, any Nix version older than 2.35.3 that includes the multi-user installer is potentially vulnerable. All platforms where the installer is available fall under this risk scope.

The CVSS score of 4 indicates moderate severity, and the EPSS score indicates a very low probability of exploitation. The vulnerability is not listed in the CISA KEV catalog, suggesting no confirmed widespread exploitation. Attackers would need local access to run the installer, so the risk remains limited to environments where unprivileged users can invoke the installer or where a compromised installer script is already running.