CVE catalog
CVE-2025-52992
DEBIAN-CVE-2025-52992
- Severity
- Unknown
- Published
- Updated
- Source
- [NVD] · [CVE record]
- EPSS
- 0.17% · Oct 25, 2026
The Nix, Lix, and Guix package managers fail to properly set permissions when a derivation build fails. This may allow arbitrary processes to modify the content of a store outside of the build sandbox. This affects Nix before 2.24.15, 2.26.4, 2.28.4, and 2.29.1; Lix before 2.91.2, 2.92.2, and 2.93.1; and Guix before 1.4.0-38.0e79d5b.
Vulnerable and fixed packages
Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.
| Distribution | Package | Release | Version | Status |
|---|---|---|---|---|
| Ubuntu | guix | pro | 1.2.0-4 | vulnerable |
| Ubuntu | guix | pro | 1.3.0-2 | vulnerable |
| Ubuntu | guix | pro | 1.3.0-4 | vulnerable |
| Ubuntu | guix | pro | 1.3.0-4ubuntu0.1~esm1 | vulnerable |
| Ubuntu | guix | pro | 1.4.0-5 | vulnerable |
| Ubuntu | guix | pro | 1.4.0-6 | vulnerable |
| Ubuntu | guix | pro | 1.4.0-6build1 | vulnerable |
| Ubuntu | guix | pro | 1.4.0-6ubuntu0.1~esm1 | vulnerable |
| Debian | guix | 11 | 1.2.0-4 | vulnerable |
| Debian | guix | 11 | 1.2.0-4+deb11u1 | vulnerable |
| Debian | guix | 11 | 1.2.0-4+deb11u2 | vulnerable |
| Debian | guix | 11 | 1.2.0-4+deb11u3 | vulnerable |
| Debian | guix | 11 | 1.3.0+26720.a2e4e-1 | vulnerable |
| Debian | guix | 11 | 1.3.0+26756.c07b5-1 | vulnerable |
| Debian | guix | 11 | 1.3.0+26756.c07b5-2 | vulnerable |
| Debian | guix | 11 | 1.3.0-1 | vulnerable |
| Debian | guix | 11 | 1.3.0-2 | vulnerable |
| Debian | guix | 11 | 1.3.0-3 | vulnerable |
| Debian | guix | 11 | 1.3.0-4 | vulnerable |
| Debian | guix | 11 | 1.3.0-5 | vulnerable |
| Debian | guix | 11 | 1.3.0~rc1-1 | vulnerable |
| Debian | guix | 11 | 1.4.0+154709.ab1b557d8f3-1 | vulnerable |
| Debian | guix | 11 | 1.4.0+154710+ab1b5-1 | vulnerable |
| Debian | guix | 11 | 1.4.0+154710+ab1b5-2 | vulnerable |
| Debian | guix | 11 | 1.4.0+154928+f1810-1 | vulnerable |
| Debian | guix | 11 | 1.4.0-1 | vulnerable |
| Debian | guix | 11 | 1.4.0-2 | vulnerable |
| Debian | guix | 11 | 1.4.0-3 | vulnerable |
| Debian | guix | 11 | 1.4.0-4 | vulnerable |
| Debian | guix | 11 | 1.4.0-5 | vulnerable |
| Debian | guix | 11 | 1.4.0-6 | vulnerable |
| Debian | guix | 11 | 1.4.0-7 | vulnerable |
| Debian | guix | 11 | 1.4.0-8 | vulnerable |
| Debian | guix | 11 | 1.4.0-9 | vulnerable |
| Debian | guix | 11 | 1.4.0~rc1-1 | vulnerable |
| Debian | guix | 11 | 1.4.0~rc1-2 | vulnerable |
| Debian | guix | 11 | 1.4.0~rc2-1 | vulnerable |
Fixed-version evidence
OpenFactory catalog packages
No matching packages in this catalog.
Observed: