CVE-2025-59378 Privilege escalation in Guix
A local attacker can create a setuid program via content-addressed mirrors to gain build user privileges in GNU Guix.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2025-59378?
CVE-2025-59378 is a medium-severity vulnerability in GNU Guix, published on 15 Sep 2025. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In guix-daemon in GNU Guix before 1618ca7, a content-addressed-mirrors file can be written to create a setuid program that allows a regular user to gain the privileges of the build user that runs it (even after the build has ended).
Weakness: CWE-669
Which versions are affected by CVE-2025-59378?
How do I fix CVE-2025-59378?
No fix has been published for CVE-2025-59378 yet. Limit exposure of the affected software until one is available.
Is CVE-2025-59378 being exploited?
There is no known exploitation of CVE-2025-59378 in the wild and no public exploit code.
Sources
Also known as DEBIAN-CVE-2025-59378, GHSA-75hx-v6j6-m6h7, UBUNTU-CVE-2025-59378.