The advisory covers two CVEs, including CVE-2026-44029, which is an absolute path traversal vulnerability in Nix. This flaw allows attackers to write to arbitrary files via the 'nix-prefetch-url --unpack' or 'nix store prefetch-file --unpack' commands, leading to potential unauthorized code execution, file modification, and denial of service. The vulnerability is tracked under CWE-36 (Absolute Path Traversal) and CWE-674 (Improper Control of a Resource Through its Lifetime). Red Hat has released updated RPM packages for Rust components as part of the remediation effort. The advisory notes that CVSS scoring may differ from other sources due to vendor-specific factors. No known exploits are reported in the wild at this time.

The vulnerability allows an attacker with local access to perform directory traversal when unpacking archives, enabling them to create or overwrite critical files such as programs or libraries. This can lead to unauthorized code execution, modification of security mechanisms, exposure of sensitive data, and denial of service by corrupting essential files. The impact affects system integrity and availability, potentially allowing attackers to bypass security controls or disrupt system operation.

Red Hat has released updated RPM packages for the affected components as part of this advisory. Users should apply these official fixes promptly to remediate the vulnerability. No alternative mitigations or workarounds are specified in the advisory. Customers are advised to monitor Red Hat's official channels for updates and apply patches as they become available. Since this is not a cloud service, remediation is the responsibility of the system administrators.