CVE-2026-2644: 
NixOS vulnerability analysis and mitigation

CVE-2026-2644 is a heap buffer overflow (out-of-bounds read) vulnerability in niklasso MiniSat, a minimalistic SAT solver, affecting all versions up to and including 2.2.0. The flaw resides in the Solver::value function within core/SolverTypes.h, triggered when the DIMACS file parser processes a variable index of 2147483648 (2³¹, one greater than INT_MAX). The vulnerability was reported via a GitHub issue on January 20, 2026, and publicly disclosed on February 18, 2026, with the upstream project not yet responding to the report. It carries a CVSS v3.1 base score of 7.8 (High) for local exploitation scenarios, though CVSS v4.0 rates it 1.9 (Low) given its limited real-world impact (Red Hat Bugzilla, GitHub Issue).

The root cause is an integer overflow (CWE-190) combined with an out-of-bounds read (CWE-125) in the DIMACS file parser. When MiniSat parses a clause containing the variable index 2147483648, this value exceeds INT_MAX (2³¹−1) and wraps around to -2147483648 when stored as a signed 32-bit integer. When Solver::value(Lit p) subsequently calls assigns[var(p)], the negative index causes a heap buffer underflow — accessing memory 1 byte before the allocated assigns array. The ASAN-confirmed call chain is: parse_DIMACS → readClause → addClause_ → Solver::value → lbool::operator^ at core/SolverTypes.h:105. Exploitation requires only a crafted DIMACS input file and local execution of the minisat binary (GitHub Issue).

Successful exploitation causes a denial of service via application crash (abort) when minisat processes a malformed DIMACS file. The primary impact is availability loss; the ASAN report confirms a READ violation rather than an exploitable write primitive, making arbitrary code execution unlikely under normal conditions. Confidentiality and integrity impacts are assessed as low in practice, as the crash terminates the process before meaningful data exfiltration or modification can occur (GitHub Issue, Red Hat Bugzilla).

A public proof-of-concept exploit is available in the GitHub issue report, including a crafted DIMACS file and ASAN output demonstrating the crash. The EPSS score is 0.013% (very low), and there is no evidence of in-the-wild exploitation or inclusion in the CISA KEV catalog. No threat actor attribution has been reported. The vulnerability requires local access with low privileges, significantly limiting its attack surface (GitHub Issue, Feedly).

1. Prepare the malicious DIMACS file: Create a file (e.g., poc.cnf) containing a clause with the oversized variable index 2147483648, such as:

p cnf 5 5
3 -1 0
1 0
-3 0
2147483648 3 -1 0
-1 0

2. Build or obtain a vulnerable minisat binary: Compile minisat version ≤ 2.2.0 from the upstream repository, optionally with ASan enabled to observe the crash clearly.
3. Execute minisat with the crafted file: Run ./minisat poc.cnf /dev/null locally as any low-privileged user.
4. Trigger the integer overflow: The parser reads 2147483648, which overflows the signed 32-bit int variable index to -2147483648, and passes it to Solver::value.
5. Observe the crash: assigns[-2147483648] performs a heap buffer underflow, causing an immediate abort (SIGABRT) or ASan-reported heap-buffer-overflow, resulting in denial of service (GitHub Issue).

• Process: Unexpected termination (SIGABRT or SIGSEGV) of the minisat process; core dump files generated in the working directory.
• Logs: Application crash logs or ASan output containing heap-buffer-overflow in Minisat::lbool::operator^ at core/SolverTypes.h:105; system logs showing abnormal minisat process exits.
• File System: Presence of crafted DIMACS files containing the value 2147483648 as a variable index in clause lines; unexpected .cnf files in temporary or user-writable directories.
• Process: Child processes of minisat unexpectedly absent (process killed before completion) when processing user-supplied input files (GitHub Issue).

No official patch has been released by the upstream niklasso/minisat project as of the disclosure date, and the maintainer has not responded to the issue report. Red Hat has tracked the issue in its bug system (Bug 2440545) with low severity. Recommended mitigations include: (1) restricting local user access to the minisat binary; (2) validating and sanitizing DIMACS file inputs before processing, rejecting variable indices exceeding INT_MAX; (3) running minisat in a sandboxed or containerized environment to limit crash impact; and (4) monitoring for unexpected minisat process terminations. Users should watch the upstream repository for a future patch (Red Hat Bugzilla, minisat GitHub).

Red Hat tracked the vulnerability at low severity in its Bugzilla system, reflecting the limited real-world risk due to the local-only attack vector. The upstream minisat project has not responded to the GitHub issue report as of disclosure. No significant media coverage or notable researcher commentary beyond the initial bug report has been identified (Red Hat Bugzilla, GitHub Issue).