CVE-2026-110451: CWE-863 Incorrect Authorization in NixOS Nix

This vulnerability affects Nix versions on macOS prior to 2.35.3 and Lix before 2.95.4. The flaw is an incorrect authorization (CWE-863) that allows a Seatbelt sandbox escape when an unconfined build is performed. The issue arises because a certain size threshold is mishandled, enabling the sandbox escape. The CVSS 3.1 base score is 4.3, indicating medium severity with local attack vector, low attack complexity, no privileges required, no user interaction, and a scope change. The impact is limited to integrity loss without confidentiality or availability impact.

The vulnerability allows an attacker to escape the macOS Seatbelt sandbox during an unconfined build, potentially leading to unauthorized integrity modifications. There is no impact on confidentiality or availability. The attack requires local access and has low complexity, but no privileges or user interaction are needed. No known exploits are reported in the wild.

No explicit patch links are provided in the input data. The vulnerability affects versions prior to 2.35.3 on Nix and prior to 2.95.4 on Lix. Users should upgrade to versions 2.35.3 or later for Nix and 2.95.4 or later for Lix to remediate this issue. Patch status is not explicitly confirmed in the input data; therefore, users should consult the official NixOS vendor advisory for the latest remediation guidance.