{"id":"CVE-2025-9301","aliases":["AZL-66554","AZL-66557","BELL-CVE-2025-9301","DEBIAN-CVE-2025-9301","EUVD-2025-25423","GHSA-mff3-m38v-mgv6","MGASA-2026-0069","OESA-2025-2145","OESA-2025-2146","OESA-2025-2147","OESA-2025-2148","OESA-2025-2254","SUSE-SU-2025:02975-1","SUSE-SU-2025:02976-1","SUSE-SU-2025:03281-1","SUSE-SU-2025:3812-1","UBUNTU-CVE-2025-9301"],"status":"published","title":"cmake cmForEachCommand.cxx ReplayItems assertion","description":"A vulnerability was determined in cmake 4.1.20250725-gb5cce23. This affects the function cmForEachFunctionBlocker::ReplayItems of the file cmForEachCommand.cxx. This manipulation causes reachable assertion. The attack needs to be launched locally. The exploit has been publicly disclosed and may be utilized. Patch name: 37e27f71bc356d880c908040cd0cb68fa2c371b8. It is suggested to install a patch to address this issue.","severity":{"version":"4.0","score":4.8,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.00155,"percentile":0.04678,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-617"],"published":"2025-08-21T13:32:08Z","modified":"2026-11-05T05:40:51Z","fixes":[{"ecosystem":"Azure Linux:2","package":"cmake","fixed_in":["3.21.4-19"],"sources":["osv"]},{"ecosystem":"Azure Linux:3","package":"cmake","fixed_in":["3.30.3-9"],"sources":["osv"]},{"ecosystem":"Mageia:9","package":"cmake","fixed_in":["3.26.4-1.1.mga9"],"sources":["osv"]},{"ecosystem":"openEuler:22.03-LTS-SP3","package":"cmake","fixed_in":["3.22.0-11.oe2203sp3"],"sources":["osv"]},{"ecosystem":"openEuler:22.03-LTS-SP4","package":"cmake","fixed_in":["3.22.0-11.oe2203sp4"],"sources":["osv"]},{"ecosystem":"openEuler:24.03-LTS-SP1","package":"cmake","fixed_in":["3.27.9-8.oe2403sp1"],"sources":["osv"]},{"ecosystem":"openEuler:24.03-LTS-SP2","package":"cmake","fixed_in":["3.27.9-8.oe2403sp2"],"sources":["osv"]},{"ecosystem":"openEuler:24.03-LTS","package":"cmake","fixed_in":["3.27.9-7.oe2403"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.6","package":"cmake3","fixed_in":["3.20.0-150200.6.6.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.6","package":"cmake3-full","fixed_in":["3.20.0-150200.6.6.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.6","package":"cmake3-ui","fixed_in":["3.17.0-150000.1.9.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP6","package":"cmake","fixed_in":["3.28.3-150600.3.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP6","package":"cmake-full","fixed_in":["3.28.3-150600.3.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP7","package":"cmake","fixed_in":["3.28.3-150600.3.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP7","package":"cmake-full","fixed_in":["3.28.3-150600.3.3.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.6","package":"cmake","fixed_in":["3.28.3-150600.3.3.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.6","package":"cmake-full","fixed_in":["3.28.3-150600.3.3.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.6","package":"cmake-ui","fixed_in":["3.28.3-150600.3.3.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Azure Linux:2","package":"cmake","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.21.4-19"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"cmake","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.30.3-9"}]}]},{"source":"osv","ecosystem":"Alpaquita:23","package":"cmake","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.24.3-r0"}]}]},{"source":"osv","ecosystem":"Alpaquita:25","package":"cmake","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.31.7-r0"}]}]},{"source":"osv","ecosystem":"Alpaquita:stream","package":"cmake","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.26.4-r1"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"cmake","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.25.1-1","3.26.4-1","3.26.4-2","3.26.4-3","3.26.4-4","3.26.4-4~bpo12+1","3.27.0-1","3.27.0-2","3.27.0~rc4-1","3.27.0~rc4-2","3.27.0~rc4-3","3.27.0~rc5-1","3.27.1-1","3.27.1-2","3.27.2-1","3.27.2-1~bpo12+1","3.27.3-1","3.27.4-1","3.27.4-1~bpo12+1","3.27.5-1","3.27.5-1~bpo12+1","3.27.6-1","3.27.6-1~bpo12+1","3.27.7-1","3.27.7-1~bpo12+1","3.27.8-1","3.27.8-1~bpo12+1","3.27.9-1","3.27.9-1~bpo12+1","3.28.0-1","3.28.1-1","3.28.1-1~bpo12+1","3.28.2-1","3.28.3-1","3.28.3-1~bpo12+1","3.29.2-1","3.29.2-2","3.29.2-2~bpo12+1","3.29.3-1","3.29.3-1~bpo12+1","3.29.4-1","3.29.4-1~bpo12+1","3.29.5-1","3.29.5-1~bpo12+1","3.29.6-1","3.29.6-1~bpo12+1","3.30.0-1","3.30.1-1","3.30.2-1","3.30.2-2","3.30.2-2~bpo12+1","3.30.3-1","3.30.3-1~bpo12+1","3.30.4-1","3.30.4-1~bpo12+1","3.30.5-1","3.30.5-1.1","3.30.5-1~bpo12+1","3.31.0-1","3.31.0-2","3.31.1-1","3.31.2-1","3.31.3-1","3.31.4-2","3.31.4-2~bpo12+1","3.31.5-1","3.31.5-1~bpo12+1","3.31.5-2","3.31.5-2~bpo12+1","3.31.6-1","3.31.6-1~bpo12+1","3.31.6-2","3.31.6-2~bpo12+1","4.0.0-1","4.0.1-1","4.0.2-1","4.0.3-1","4.1.0-1","4.1.1+really3.31.6-1","4.1.1+really3.31.6-2","4.1.1+really4.1.1-1","4.1.1-1","4.1.1-2","4.1.2-1","4.2.0-1","4.2.0-2","4.2.1-1","4.2.1-2","4.2.2-1","4.2.2-2","4.2.3-1","4.2.3-1~bpo13+1","4.2.3-2","4.2.3-2~bpo13+1","4.3.0-1","4.3.0-2","4.3.0-3","4.3.0~rc3-1","4.3.1-1","4.3.1-1~bpo13+1","4.3.2-1","4.3.2-1~bpo13+1","4.3.3-1","4.3.3-1~bpo13+1","4.3.4-1","4.3.4-1~bpo13+1","4.4.0-1","4.4.2-1"]},{"source":"osv","ecosystem":"Debian:13","package":"cmake","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.31.6-2","4.0.0-1","4.0.1-1","4.0.2-1","4.0.3-1","4.1.0-1","4.1.1+really3.31.6-1","4.1.1+really3.31.6-2","4.1.1+really4.1.1-1","4.1.1-1","4.1.1-2","4.1.2-1","4.2.0-1","4.2.0-2","4.2.1-1","4.2.1-2","4.2.2-1","4.2.2-2","4.2.3-1","4.2.3-1~bpo13+1","4.2.3-2","4.2.3-2~bpo13+1","4.3.0-1","4.3.0-2","4.3.0-3","4.3.0~rc3-1","4.3.1-1","4.3.1-1~bpo13+1","4.3.2-1","4.3.2-1~bpo13+1","4.3.3-1","4.3.3-1~bpo13+1","4.3.4-1","4.3.4-1~bpo13+1","4.4.0-1","4.4.2-1"]},{"source":"osv","ecosystem":"Debian:14","package":"cmake","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.31.6-2","4.0.0-1","4.0.1-1","4.0.2-1","4.0.3-1","4.1.0-1","4.1.1+really3.31.6-1","4.1.1+really3.31.6-2","4.1.1+really4.1.1-1","4.1.1-1","4.1.1-2","4.1.2-1","4.2.0-1","4.2.0-2","4.2.1-1","4.2.1-2","4.2.2-1","4.2.2-2","4.2.3-1","4.2.3-1~bpo13+1","4.2.3-2","4.2.3-2~bpo13+1","4.3.0-1","4.3.0-2","4.3.0-3","4.3.0~rc3-1","4.3.1-1","4.3.1-1~bpo13+1","4.3.2-1","4.3.2-1~bpo13+1","4.3.3-1","4.3.3-1~bpo13+1","4.3.4-1","4.3.4-1~bpo13+1","4.4.0-1","4.4.2-1"]},{"source":"osv","ecosystem":"Mageia:9","package":"cmake","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.26.4-1.1.mga9"}]}]},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP3","package":"cmake","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.22.0-11.oe2203sp3"}]}]},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP4","package":"cmake","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.22.0-11.oe2203sp4"}]}]},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP1","package":"cmake","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.27.9-8.oe2403sp1"}]}]},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP2","package":"cmake","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.27.9-8.oe2403sp2"}]}]},{"source":"osv","ecosystem":"openEuler:24.03-LTS","package":"cmake","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.27.9-7.oe2403"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.6","package":"cmake3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.20.0-150200.6.6.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.6","package":"cmake3-full","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.20.0-150200.6.6.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.6","package":"cmake3-ui","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.17.0-150000.1.9.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP6","package":"cmake","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.28.3-150600.3.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP6","package":"cmake-full","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.28.3-150600.3.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP7","package":"cmake","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.28.3-150600.3.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP7","package":"cmake-full","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.28.3-150600.3.3.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.6","package":"cmake","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.28.3-150600.3.3.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.6","package":"cmake-full","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.28.3-150600.3.3.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.6","package":"cmake-ui","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.28.3-150600.3.3.1"}]}]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"cmake","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.2.2-2ubuntu3","3.2.2-2ubuntu4","3.3.2-1ubuntu1","3.3.2is3.2.2-0ubuntu1","3.3.2is3.2.2-0ubuntu2","3.3.2is3.2.2-0ubuntu4","3.3.2is3.2.2-0ubuntu5","3.5.0-1ubuntu1","3.5.0-1ubuntu2","3.5.0-1ubuntu3","3.5.1-1ubuntu1","3.5.1-1ubuntu2","3.5.1-1ubuntu3"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"cmake","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.9.1-1","3.9.3-1","3.9.5-1","3.10.2-1","3.10.2-1build1","3.10.2-1ubuntu1","3.10.2-1ubuntu2","3.10.2-1ubuntu2.18.04.1","3.10.2-1ubuntu2.18.04.2"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"cmake","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.13.4-1build1","3.15.4-1","3.15.4-1ubuntu2","3.15.4-1ubuntu3","3.16.3-1ubuntu1","3.16.3-1ubuntu1.20.04.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"cmake","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.18.4-2ubuntu2","3.21.4-1ubuntu2","3.22.1-1ubuntu1","3.22.1-1ubuntu1.22.04.1","3.22.1-1ubuntu1.22.04.2"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"cmake","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.27.4-1","3.27.7-1","3.27.8-1","3.27.8-1build1","3.28.1-1","3.28.3-1","3.28.3-1build5","3.28.3-1build6","3.28.3-1build7"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"cmake","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.31.6-1ubuntu1","3.31.6-2ubuntu1","3.31.6-2ubuntu3","3.31.6-2ubuntu4","3.31.6-2ubuntu5","3.31.6-2ubuntu6"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"cmake","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.2.3-2ubuntu2","4.3.2-1ubuntu1","4.3.4-1ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"cmake","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.31.6-2ubuntu6","4.1.1+really3.31.6-2ubuntu1","4.2.3-2ubuntu1","4.2.3-2ubuntu2"]}],"references":[{"url":"https://vuldb.com/?id.320906","tags":["vdb-entry","technical-description","advisory","report"]},{"url":"https://vuldb.com/?ctiid.320906","tags":["signature","permissions-required","report"]},{"url":"https://vuldb.com/?submit.632369","tags":["third-party-advisory","advisory","report"]},{"url":"https://gitlab.kitware.com/cmake/cmake/-/issues/27135","tags":["issue-tracking","report"]},{"url":"https://gitlab.kitware.com/cmake/cmake/-/issues/27135#note_1691629","tags":["issue-tracking","report"]},{"url":"https://drive.google.com/file/d/1TerUqQB8_lzJTwIBCBmE94zn7n-gOz4f/view?usp=sharing","tags":["exploit","evidence","report"]},{"url":"https://gitlab.kitware.com/cmake/cmake/-/commit/37e27f71bc356d880c908040cd0cb68fa2c371b8","tags":["patch","fix"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-9301","tags":["web","advisory"]},{"url":"https://github.com/advisories/GHSA-mff3-m38v-mgv6"},{"url":"https://docs.bell-sw.com/security/cves/CVE-2025-9301","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/9xxx/CVE-2025-9301.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2025-9301","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2026-0069.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=35263","tags":["report"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LRYGBCSAOIXW3H7GXSATU2RXSYBKTGFL/","tags":["web"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2025-2145","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2025-2146","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2025-2147","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2025-2148","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2025-2254","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2025/suse-su-202502975-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1248461","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2025-9301","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2025/suse-su-202502976-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2025/suse-su-202503281-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2025/suse-su-20253812-1/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2025-9301","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-9301","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2025-9301","title":"cmake cmForEachCommand.cxx ReplayItems assertion","description":"A vulnerability was determined in cmake 4.1.20250725-gb5cce23. This affects the function cmForEachFunctionBlocker::ReplayItems of the file cmForEachCommand.cxx. This manipulation causes reachable assertion. The attack needs to be launched locally. The exploit has been publicly disclosed and may be utilized. Patch name: 37e27f71bc356d880c908040cd0cb68fa2c371b8. It is suggested to install a patch to address this issue.","status":"published","published":"2025-08-21T13:32:08.995Z","modified":"2025-08-21T13:49:58.107Z","cvss":[{"version":"4.0","score":4.8,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P","level":"medium","assessor":"cna"},{"version":"3.1","score":3.3,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L/E:P/RL:O/RC:C","level":"low","assessor":"cna"},{"version":"3.0","score":3.3,"vector":"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L/E:P/RL:O/RC:C","level":"low","assessor":"cna"},{"version":"2.0","score":1.7,"vector":"AV:L/AC:L/Au:S/C:N/I:N/A:P/E:POC/RL:OF/RC:C","assessor":"cna"}],"cwes":["CWE-617"],"updated_at":"2026-11-02T14:32:34.096798Z"}],"euvd":[{"id":"EUVD-2025-25423","description":"A vulnerability was determined in cmake 4.1.20250725-gb5cce23. This affects the function cmForEachFunctionBlocker::ReplayItems of the file cmForEachCommand.cxx. This manipulation causes reachable assertion. The attack needs to be launched locally. The exploit has been publicly disclosed and may be utilized. Patch name: 37e27f71bc356d880c908040cd0cb68fa2c371b8. It is suggested to install a patch to address this issue.","status":"published","published":"2025-08-21T13:32:08Z","modified":"2025-08-21T13:49:58Z","cvss":[{"version":"4.0","score":4.8,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P","level":"medium"}],"updated_at":"2026-11-02T20:31:55.037702Z"}],"ghsa":[{"id":"GHSA-mff3-m38v-mgv6","title":"A vulnerability was determined in cmake 4.1.20250725-gb5cce23. This affects the function...","description":"A vulnerability was determined in cmake 4.1.20250725-gb5cce23. This affects the function cmForEachFunctionBlocker::ReplayItems of the file cmForEachCommand.cxx. This manipulation causes reachable assertion. The attack needs to be launched locally. The exploit has been publicly disclosed and may be utilized. Patch name: 37e27f71bc356d880c908040cd0cb68fa2c371b8. It is suggested to install a patch to address this issue.","status":"published","published":"2025-08-21T15:30:35Z","modified":"2025-08-21T15:30:42Z","cvss":[{"version":"4.0","score":1.9,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"low"},{"version":"3.1","score":3.3,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L","level":"low"}],"cwes":["CWE-617"],"updated_at":"2026-11-02T15:03:22.079982Z"}],"nvd":[{"id":"CVE-2025-9301","description":"A vulnerability was determined in cmake 4.1.20250725-gb5cce23. This affects the function cmForEachFunctionBlocker::ReplayItems of the file cmForEachCommand.cxx. This manipulation causes reachable assertion. The attack needs to be launched locally. The exploit has been publicly disclosed and may be utilized. Patch name: 37e27f71bc356d880c908040cd0cb68fa2c371b8. It is suggested to install a patch to address this issue.","status":"published","published":"2025-08-21T14:15:44.137Z","modified":"2026-06-17T10:08:42.447Z","cvss":[{"version":"4.0","score":1.9,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"low","assessor":"secondary"},{"version":"3.1","score":3.3,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L","level":"low","assessor":"secondary"},{"version":"2.0","score":1.7,"vector":"AV:L/AC:L/Au:S/C:N/I:N/A:P","level":"low","assessor":"secondary"}],"cwes":["CWE-617"],"updated_at":"2026-11-02T14:11:25.261243Z"}],"osv":[{"id":"BELL-CVE-2025-9301","status":"published","published":"2025-08-22T06:03:27.314765Z","modified":"2026-01-26T09:41:05.626963Z","cvss":[{"version":"3.1","score":3.3,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L","level":"low"}],"updated_at":"2026-11-02T15:28:23.037038Z"},{"id":"CVE-2025-9301","title":"cmake cmForEachCommand.cxx ReplayItems assertion","description":"A vulnerability was determined in cmake 4.1.20250725-gb5cce23. This affects the function cmForEachFunctionBlocker::ReplayItems of the file cmForEachCommand.cxx. This manipulation causes reachable assertion. The attack needs to be launched locally. The exploit has been publicly disclosed and may be utilized. Patch name: 37e27f71bc356d880c908040cd0cb68fa2c371b8. It is suggested to install a patch to address this issue.","status":"published","published":"2025-08-21T13:32:08.995Z","modified":"2026-08-12T15:31:14.384474Z","cvss":[{"version":"4.0","score":1.9,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P","level":"low"}],"cwes":["CWE-617"],"updated_at":"2026-11-02T15:44:53.490346Z"},{"id":"DEBIAN-CVE-2025-9301","description":"A vulnerability was determined in cmake 4.1.20250725-gb5cce23. This affects the function cmForEachFunctionBlocker::ReplayItems of the file cmForEachCommand.cxx. This manipulation causes reachable assertion. The attack needs to be launched locally. The exploit has been publicly disclosed and may be utilized. Patch name: 37e27f71bc356d880c908040cd0cb68fa2c371b8. It is suggested to install a patch to address this issue.","status":"published","published":"2025-08-21T14:15:44.137Z","modified":"2026-09-01T20:05:59.138933345Z","cvss":[{"version":"4.0","score":1.9,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"low"}],"updated_at":"2026-11-02T15:45:48.440897Z"},{"id":"OESA-2025-2145","title":"cmake security update","description":"CMake is used to control the software compilation process using simple platform and compiler independent configuration files. CMake generates native makefiles and workspaces that can be used in the compiler environment of your choice. CMake is quite sophisticated: it is possible to support complex environments requiring system configuration, preprocessor generation, code generation, and template instantiation.\r\n\r\nSecurity Fix(es):\n\nA vulnerability was identified in cmake version 4.1.20250725-gb5cce23, affecting the cmForEachFunctionBlocker::ReplayItems function in the cmForEachCommand.cxx file. This vulnerability can lead to a reachable assertion error and requires local access to exploit. The exploit details have been publicly disclosed and may be utilized. It is recommended to apply patch 37e27f71bc356d880c908040cd0cb68fa2c371b8 to mitigate this issue.(CVE-2025-9301)","status":"published","published":"2025-09-05T11:09:13Z","modified":"2026-08-18T01:18:40.155737493Z","cvss":[{"version":"3.1","score":3.3,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L","level":"low"}],"updated_at":"2026-11-02T15:52:43.127925Z"},{"id":"OESA-2025-2146","title":"cmake security update","description":"CMake is used to control the software compilation process using simple platform and compiler independent configuration files. CMake generates native makefiles and workspaces that can be used in the compiler environment of your choice. CMake is quite sophisticated: it is possible to support complex environments requiring system configuration, preprocessor generation, code generation, and template instantiation.\r\n\r\nSecurity Fix(es):\n\nA vulnerability was identified in cmake version 4.1.20250725-gb5cce23, affecting the cmForEachFunctionBlocker::ReplayItems function in the cmForEachCommand.cxx file. This vulnerability can lead to a reachable assertion error and requires local access to exploit. The exploit details have been publicly disclosed and may be utilized. It is recommended to apply patch 37e27f71bc356d880c908040cd0cb68fa2c371b8 to mitigate this issue.(CVE-2025-9301)","status":"published","published":"2025-09-05T11:09:13Z","modified":"2026-08-18T01:18:10.296493432Z","cvss":[{"version":"3.1","score":3.3,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L","level":"low"}],"updated_at":"2026-11-02T15:52:43.127925Z"},{"id":"OESA-2025-2147","title":"cmake security update","description":"CMake is used to control the software compilation process using simple platform and compiler independent configuration files. CMake generates native makefiles and workspaces that can be used in the compiler environment of your choice. CMake is quite sophisticated: it is possible to support complex environments requiring system configuration, preprocessor generation, code generation, and template instantiation.\r\n\r\nSecurity Fix(es):\n\nA vulnerability was identified in cmake version 4.1.20250725-gb5cce23, affecting the cmForEachFunctionBlocker::ReplayItems function in the cmForEachCommand.cxx file. This vulnerability can lead to a reachable assertion error and requires local access to exploit. The exploit details have been publicly disclosed and may be utilized. It is recommended to apply patch 37e27f71bc356d880c908040cd0cb68fa2c371b8 to mitigate this issue.(CVE-2025-9301)","status":"published","published":"2025-09-05T11:09:14Z","modified":"2026-08-18T01:18:10.097602562Z","cvss":[{"version":"3.1","score":3.3,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L","level":"low"}],"updated_at":"2026-11-02T15:52:43.127925Z"},{"id":"OESA-2025-2148","title":"cmake security update","description":"CMake is used to control the software compilation process using simple platform and compiler independent configuration files. CMake generates native makefiles and workspaces that can be used in the compiler environment of your choice. CMake is quite sophisticated: it is possible to support complex environments requiring system configuration, preprocessor generation, code generation, and template instantiation.\r\n\r\nSecurity Fix(es):\n\nA vulnerability was identified in cmake version 4.1.20250725-gb5cce23, affecting the cmForEachFunctionBlocker::ReplayItems function in the cmForEachCommand.cxx file. This vulnerability can lead to a reachable assertion error and requires local access to exploit. The exploit details have been publicly disclosed and may be utilized. It is recommended to apply patch 37e27f71bc356d880c908040cd0cb68fa2c371b8 to mitigate this issue.(CVE-2025-9301)","status":"published","published":"2025-09-05T11:09:14Z","modified":"2026-08-18T01:18:09.761762788Z","cvss":[{"version":"3.1","score":3.3,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L","level":"low"}],"updated_at":"2026-11-02T15:52:43.127925Z"},{"id":"OESA-2025-2254","title":"cmake security update","description":"CMake is used to control the software compilation process using simple platform and compiler independent configuration files. CMake generates native makefiles and workspaces that can be used in the compiler environment of your choice. CMake is quite sophisticated: it is possible to support complex environments requiring system configuration, preprocessor generation, code generation, and template instantiation.\r\n\r\nSecurity Fix(es):\n\nA vulnerability was identified in cmake version 4.1.20250725-gb5cce23, affecting the cmForEachFunctionBlocker::ReplayItems function in the cmForEachCommand.cxx file. This vulnerability can lead to a reachable assertion error and requires local access to exploit. The exploit details have been publicly disclosed and may be utilized. It is recommended to apply patch 37e27f71bc356d880c908040cd0cb68fa2c371b8 to mitigate this issue.(CVE-2025-9301)","status":"published","published":"2025-09-12T11:09:19Z","modified":"2026-08-18T01:19:09.454362812Z","cvss":[{"version":"3.1","score":3.3,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L","level":"low"}],"updated_at":"2026-11-02T15:52:44.957082Z"},{"id":"UBUNTU-CVE-2025-9301","description":"A vulnerability was determined in cmake 4.1.20250725-gb5cce23. This affects the function cmForEachFunctionBlocker::ReplayItems of the file cmForEachCommand.cxx. This manipulation causes reachable assertion. The attack needs to be launched locally. The exploit has been publicly disclosed and may be utilized. Patch name: 37e27f71bc356d880c908040cd0cb68fa2c371b8. It is suggested to install a patch to address this issue.","status":"published","published":"2025-08-21T14:15:00Z","modified":"2026-10-17T12:59:40.277389665Z","cvss":[{"version":"3.1","score":3.3,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L","level":"low"},{"version":"4.0","score":1.9,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P","level":"low"}],"updated_at":"2026-11-02T16:55:55.926217Z"},{"id":"AZL-66554","title":"CVE-2025-9301 affecting package cmake for versions less than 3.21.4-19","description":"A vulnerability was determined in cmake 4.1.20250725-gb5cce23. This affects the function cmForEachFunctionBlocker::ReplayItems of the file cmForEachCommand.cxx. This manipulation causes reachable assertion. The attack needs to be launched locally. The exploit has been publicly disclosed and may be utilized. Patch name: 37e27f71bc356d880c908040cd0cb68fa2c371b8. It is suggested to install a patch to address this issue.","status":"published","published":"2025-08-21T14:15:44Z","modified":"2026-04-21T04:37:54.758877Z","updated_at":"2026-11-02T15:28:08.354547Z"},{"id":"AZL-66557","title":"CVE-2025-9301 affecting package cmake for versions less than 3.30.3-9","description":"A vulnerability was determined in cmake 4.1.20250725-gb5cce23. This affects the function cmForEachFunctionBlocker::ReplayItems of the file cmForEachCommand.cxx. This manipulation causes reachable assertion. The attack needs to be launched locally. The exploit has been publicly disclosed and may be utilized. Patch name: 37e27f71bc356d880c908040cd0cb68fa2c371b8. It is suggested to install a patch to address this issue.","status":"published","published":"2025-08-21T14:15:44Z","modified":"2026-11-05T05:40:51Z","updated_at":"2026-11-05T16:41:23.841127Z"},{"id":"MGASA-2026-0069","title":"Updated cmake packages fix security vulnerability","description":"cmake cmForEachCommand.cxx ReplayItems assertion. (CVE-2025-9301\n","status":"published","published":"2026-03-27T22:54:33Z","modified":"2026-04-16T04:42:27.456370983Z","updated_at":"2026-11-02T15:49:43.178336Z"},{"id":"SUSE-SU-2025:02975-1","title":"Security update for cmake3","description":"This update for cmake3 fixes the following issues:\n\n- CVE-2025-9301: Fixed assertion failure due to improper validation (bsc#1248461)\n","status":"published","published":"2025-08-25T10:42:11Z","modified":"2026-03-23T04:46:57.351528Z","updated_at":"2026-11-02T15:53:57.111474Z"},{"id":"SUSE-SU-2025:02976-1","title":"Security update for cmake3","description":"This update for cmake3 fixes the following issues:\n\n- CVE-2025-9301: Fixed assertion failure due to improper validation (bsc#1248461)\n","status":"published","published":"2025-08-25T12:03:07Z","modified":"2026-03-23T04:49:49.735726Z","updated_at":"2026-11-02T15:53:57.111474Z"},{"id":"SUSE-SU-2025:03281-1","title":"Security update for cmake","description":"This update for cmake fixes the following issues:\n\n- CVE-2025-9301: Fixed assertion failure due to improper validation (bsc#1248461)\n","status":"published","published":"2025-09-19T17:44:34Z","modified":"2026-02-04T03:17:59.994557Z","updated_at":"2026-11-02T15:53:57.111474Z"},{"id":"SUSE-SU-2025:3812-1","title":"Security update for cmake","description":"This update for cmake fixes the following issues:\n\n- CVE-2025-9301: Fixed assertion failure due to improper validation (bsc#1248461)\n","status":"published","published":"2025-10-27T16:13:22Z","modified":"2026-03-23T04:50:21.301254Z","updated_at":"2026-11-02T15:54:00.344164Z"}]}}