{"id":"UBUNTU-CVE-2025-46416","details":"The Nix, Lix, and Guix package managers allow a bypass of build isolation in which a user can elevate their privileges to the build user account (e.g., nixbld or guixbuild). This affects Nix through 2.24.15, 2.26.4, 2.28.4, and 2.29.1; Lix through 2.91.2, 2.92.2, and 2.93.1; and Guix before 1.4.0-38.0e79d5b.","modified":"2026-09-16T20:22:51.209326616Z","published":"2025-06-27T14:15:00Z","upstream":["CVE-2025-46416"],"references":[{"type":"REPORT","url":"https://ubuntu.com/security/CVE-2025-46416"},{"type":"REPORT","url":"https://www.cve.org/CVERecord?id=CVE-2025-46416"},{"type":"REPORT","url":"https://guix.gnu.org/en/blog/2025/privilege-escalation-vulnerabilities-2025/"},{"type":"REPORT","url":"https://codeberg.org/guix/guix/pulls/788"},{"type":"REPORT","url":"https://codeberg.org/guix/guix/commit/7173c2c0cad8afc9d8d1ad26f345b5a04f47716a"},{"type":"REPORT","url":"https://codeberg.org/guix/guix/commit/be8aca065118aa4485c02f991c51bea89034defa"},{"type":"REPORT","url":"https://codeberg.org/guix/guix/commit/fb42611b8f27960304db5a1c0d33b8371dcde2a8"},{"type":"REPORT","url":"https://codeberg.org/guix/guix/commit/c659f977bb09de6d5615e6aa9efddedc1d9ff458"},{"type":"REPORT","url":"https://codeberg.org/guix/guix/commit/0e79d5b6550729e6ce3bac1e979638ac054ba5a5"},{"type":"REPORT","url":"https://codeberg.org/guix/guix/commit/30a5d140aa5a789a362749d057754783fea83dde"}],"affected":[{"package":{"name":"guix","ecosystem":"Ubuntu:Pro:22.04:LTS","purl":"pkg:deb/ubuntu/guix?arch=source&distro=esm-apps%2Fjammy"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.2.0-4","1.3.0-2","1.3.0-4","1.3.0-4ubuntu0.1~esm1"],"ecosystem_specific":{"binaries":[{"binary_name":"guix","binary_version":"1.3.0-4ubuntu0.1~esm1"}]},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2025/UBUNTU-CVE-2025-46416.json"}},{"package":{"name":"guix","ecosystem":"Ubuntu:Pro:24.04:LTS","purl":"pkg:deb/ubuntu/guix?arch=source&distro=esm-apps%2Fnoble"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.4.0-5","1.4.0-6","1.4.0-6build1","1.4.0-6ubuntu0.1~esm1"],"ecosystem_specific":{"binaries":[{"binary_name":"guix","binary_version":"1.4.0-6ubuntu0.1~esm1"}]},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2025/UBUNTU-CVE-2025-46416.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N"},{"type":"Ubuntu","score":"medium"}]}