{"id":"CVE-2025-9301","summary":"cmake cmForEachCommand.cxx ReplayItems assertion","details":"A vulnerability was determined in cmake 4.1.20250725-gb5cce23. This affects the function cmForEachFunctionBlocker::ReplayItems of the file cmForEachCommand.cxx. This manipulation causes reachable assertion. The attack needs to be launched locally. The exploit has been publicly disclosed and may be utilized. Patch name: 37e27f71bc356d880c908040cd0cb68fa2c371b8. It is suggested to install a patch to address this issue.","modified":"2026-08-12T15:31:14.384474Z","published":"2025-08-21T13:32:08.995Z","related":["SUSE-SU-2025:02975-1","SUSE-SU-2025:02976-1","SUSE-SU-2025:03281-1","SUSE-SU-2025:3812-1"],"database_specific":{"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/9xxx/CVE-2025-9301.json","unresolved_ranges":[{"extracted_events":[{"introduced":"4.1.20250725-gb5cce23"},{"last_affected":"4.1.20250725-gb5cce23"}],"source":"AFFECTED_FIELD"}],"cna_assigner":"VulDB","cwe_ids":["CWE-617"]},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/9xxx/CVE-2025-9301.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-9301"},{"type":"ADVISORY","url":"https://vuldb.com/?id.320906"},{"type":"ADVISORY","url":"https://vuldb.com/?submit.632369"},{"type":"REPORT","url":"https://gitlab.kitware.com/cmake/cmake/-/issues/27135"},{"type":"REPORT","url":"https://gitlab.kitware.com/cmake/cmake/-/issues/27135#note_1691629"},{"type":"REPORT","url":"https://vuldb.com/?ctiid.320906"},{"type":"FIX","url":"https://gitlab.kitware.com/cmake/cmake/-/commit/37e27f71bc356d880c908040cd0cb68fa2c371b8"},{"type":"EVIDENCE","url":"https://drive.google.com/file/d/1TerUqQB8_lzJTwIBCBmE94zn7n-gOz4f/view?usp=sharing"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://gitlab.kitware.com/cmake/cmake","events":[{"introduced":"0"},{"fixed":"37e27f71bc356d880c908040cd0cb68fa2c371b8"}],"database_specific":{"source":"REFERENCES"}}],"versions":["v2.8.12","v2.8.11","v2.8.10","v2.8.9","v2.8.8","v2.8.7","v2.8.6","v2.8.5","v2.8.4","v2.8.3","v2.8.2"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-9301.json","vanir_signatures_modified":"2026-08-12T15:31:14Z","vanir_signatures":[{"target":{"file":"Source/cmForEachCommand.cxx"},"deprecated":false,"digest":{"line_hashes":["228043602418574992660422980917345339206","45640607635578571517308188507225526581","87054998341120757898501218577121764349","72846618754852695696322263449499194572"],"threshold":0.9},"id":"CVE-2025-9301-09a05382","signature_type":"Line","signature_version":"v1","source":"https://gitlab.kitware.com/cmake/cmake@37e27f71bc356d880c908040cd0cb68fa2c371b8"},{"target":{"file":"Source/cmForEachCommand.cxx","function":"cmForEachFunctionBlocker::Replay"},"deprecated":false,"digest":{"function_hash":"302829191689443455907304212024363053501","length":185},"id":"CVE-2025-9301-ef7bf956","signature_type":"Function","signature_version":"v1","source":"https://gitlab.kitware.com/cmake/cmake@37e27f71bc356d880c908040cd0cb68fa2c371b8"}]}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P"}]}