Log in Start free

Vulnerability · Published Aug 21, 2025 · Assigned by VulDB

CVE-2025-9301cmake cmForEachCommand.cxx ReplayItems assertion

Low 3.3

In plain English

A low-severity security flaw in cmake. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 5% of all known vulnerabilities).

Severity (CVSS 3.1)3.3Low
Exploit odds (30 days)0.2%top 95.3% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known

Official description

A vulnerability was determined in cmake 4.1.20250725-gb5cce23. This affects the function cmForEachFunctionBlocker::ReplayItems of the file cmForEachCommand.cxx. This manipulation causes reachable assertion. The attack needs to be launched locally. The exploit has been publicly disclosed and may be utilized. Patch name: 37e27f71bc356d880c908040cd0cb68fa2c371b8. It is suggested to install a patch to address this issue.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:12cmakeno fix listedDEBIAN-CVE-2025-9301
Debian:13cmakeno fix listedDEBIAN-CVE-2025-9301
Debian:14cmakeno fix listedDEBIAN-CVE-2025-9301
Ubuntu:22.04:LTScmakeno fix listedUBUNTU-CVE-2025-9301
Ubuntu:24.04:LTScmakeno fix listedUBUNTU-CVE-2025-9301
Ubuntu:25.10cmakeno fix listedUBUNTU-CVE-2025-9301
Ubuntu:26.04:LTScmakeno fix listedUBUNTU-CVE-2025-9301
Ubuntu:26.10cmakeno fix listedUBUNTU-CVE-2025-9301

Affected products (as reported)

VendorProductVersions
n/a cmake 4.1.20250725-gb5cce23

Weakness: CWE-617 · Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L/E:P/RL:O/RC:C

References