CVE-2025-9301

1.9 (Low) CVSS_V4 - CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X CVSS Calculator

Summary

[none]

Details

A vulnerability was determined in cmake 4.1.20250725-gb5cce23. This affects the function cmForEachFunctionBlocker::ReplayItems of the file cmForEachCommand.cxx. This manipulation causes reachable assertion. The attack needs to be launched locally. The exploit has been publicly disclosed and may be utilized. Patch name: 37e27f71bc356d880c908040cd0cb68fa2c371b8. It is suggested to install a patch to address this issue.

References

Affected packages

Git / gitlab.kitware.com/cmake/cmake

Affected ranges

Type: GIT
Repo: https://gitlab.kitware.com/cmake/cmake
Events: Introduced

0 Unknown introduced commit / All previous commits are affected

Fixed

37e27f71bc356d880c908040cd0cb68fa2c371b8

Affected versions

v2.*

v2.8.10

v2.8.11

v2.8.12

v2.8.2

v2.8.3

v2.8.4

v2.8.5

v2.8.6

v2.8.7

v2.8.8

v2.8.9

Database specific

vanir_signatures

[
    {
        "signature_version": "v1",
        "source": "https://gitlab.kitware.com/cmake/cmake@37e27f71bc356d880c908040cd0cb68fa2c371b8",
        "target": {
            "file": "Source/cmForEachCommand.cxx"
        },
        "deprecated": false,
        "id": "CVE-2025-9301-09a05382",
        "signature_type": "Line",
        "digest": {
            "line_hashes": [
                "228043602418574992660422980917345339206",
                "45640607635578571517308188507225526581",
                "87054998341120757898501218577121764349",
                "72846618754852695696322263449499194572"
            ],
            "threshold": 0.9
        }
    },
    {
        "signature_version": "v1",
        "signature_type": "Function",
        "source": "https://gitlab.kitware.com/cmake/cmake@37e27f71bc356d880c908040cd0cb68fa2c371b8",
        "deprecated": false,
        "id": "CVE-2025-9301-ef7bf956",
        "target": {
            "function": "cmForEachFunctionBlocker::Replay",
            "file": "Source/cmForEachCommand.cxx"
        },
        "digest": {
            "length": 185.0,
            "function_hash": "302829191689443455907304212024363053501"
        }
    }
]

vanir_signatures_modified

"2026-04-12T22:57:45Z"

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-9301.json"