An unbounded recursion in the Nix Archive (NAR) parser can cause a stack-to-heap overflow on a coroutine stack. The allocator creates the stack without a guard page, enabling a stack overflow to overwrite heap memory. If ASLR hardening is bypassed, an attacker that can invoke the parser on the root‑owned Nix daemon can achieve arbitrary code execution and elevate privileges to root.

The vulnerability affects the Nix package manager before version 2.34.7 and the Lix operating system before version 2.95.2. Fixed releases include Nix 2.34.7, 2.33.6, 2.32.8, 2.31.5, 2.30.5, 2.29.4, and 2.28.7, and Lix 2.95.2, 2.94.2, and 2.93.4. In multi‑user installations, the Nix daemon runs as root and accepts connections from any user unless the allowed‑users setting is restricted.

The CVSS score of 7.5 indicates a high severity vulnerability. Because the EPSS score is not available and the issue is not listed in CISA's KEV catalog, the current exploitation probability is unknown, but the existence of an unguarded stack and the ability to reach the daemon make the risk moderate to high. Exploitation requires a user that is permitted to communicate with the daemon and the ability to bypass ASLR, making the attack vector local to the affected host.