CVE-2026-110452EPSS p2.4%

CVE-2026-110452CVE-2026-110452

Description

The multi-user installer in Nix before 2.35.3 sets the ownership of store contents to the user (who invoked the installer) even though it should be root ownership.

Scoring

CVSS 4.0 ()
VectorCVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
EPSS0.13% probability of exploitation · percentile 2.4% · 2026-10-17T12:00:28Z
Last modified2026-10-16
Sourced from NVD + FIRST.org EPSS. Curated for EU compliance use cases by Adam Lundqvist, Founder at SQUR.