A vulnerability was determined in cmake 4.1.20250725-gb5cce23. This affects the function cmForEachFunctionBlocker::ReplayItems of the file cmForEachCommand.cxx. This manipulation causes reachable assertion. The attack needs to be launched locally. The exploit has been publicly disclosed and may be utilized. Patch name: 37e27f71bc356d880c908040cd0cb68fa2c371b8. It is suggested to install a patch to address this issue.

Metrics

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Attack Requirements None

User Interaction None

Vulnerable System Confidentiality Impact None

Vulnerable System Integrity Impact None

Vulnerable System Availability Impact Low

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact Low

User Interaction None

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact Low

User Interaction None

Access Vector Local

Access Complexity Low

Authentication Single

Confidentiality Impact None

Integrity Impact None

Availability Impact Partial

AV:L/AC:L/Au:S/C:N/I:N/A:P/E:POC/RL:OF/RC:C

This CVE is not in the KEV list.

Exploitation poc

Automatable no

Technical Impact partial

Affected Vendors & Products

No data.

No data.

No data.

References
Link Providers
https://drive.google.com/file/d/1TerUqQB8_lzJTwIBCBmE94zn7n-gOz4f/view?usp=sharing cve-icon cve-icon cve-icon
https://gitlab.kitware.com/cmake/cmake/-/commit/37e27f71bc356d880c908040cd0cb68fa2c371b8 cve-icon cve-icon cve-icon
https://gitlab.kitware.com/cmake/cmake/-/issues/27135 cve-icon cve-icon cve-icon
https://gitlab.kitware.com/cmake/cmake/-/issues/27135#note_1691629 cve-icon cve-icon cve-icon
https://nvd.nist.gov/vuln/detail/CVE-2025-9301 cve-icon
https://vuldb.com/?ctiid.320906 cve-icon cve-icon cve-icon
https://vuldb.com/?id.320906 cve-icon cve-icon cve-icon
https://vuldb.com/?submit.632369 cve-icon cve-icon cve-icon
https://www.cve.org/CVERecord?id=CVE-2025-9301 cve-icon
History

Fri, 22 Aug 2025 00:15:00 +0000

Type Values Removed Values Added
References
Metrics threat_severity

None

 threat_severity

Low

Thu, 21 Aug 2025 14:15:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Thu, 21 Aug 2025 13:45:00 +0000

Type Values Removed Values Added
Description A vulnerability was determined in cmake 4.1.20250725-gb5cce23. This affects the function cmForEachFunctionBlocker::ReplayItems of the file cmForEachCommand.cxx. This manipulation causes reachable assertion. The attack needs to be launched locally. The exploit has been publicly disclosed and may be utilized. Patch name: 37e27f71bc356d880c908040cd0cb68fa2c371b8. It is suggested to install a patch to address this issue.
Title cmake cmForEachCommand.cxx ReplayItems assertion
Weaknesses CWE-617
References
Metrics cvssV2_0

{'score': 1.7, 'vector': 'AV:L/AC:L/Au:S/C:N/I:N/A:P/E:POC/RL:OF/RC:C'}

cvssV3_0

{'score': 3.3, 'vector': 'CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L/E:P/RL:O/RC:C'}

cvssV3_1

{'score': 3.3, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L/E:P/RL:O/RC:C'}

cvssV4_0

{'score': 4.8, 'vector': 'CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P'}
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published: 2025-08-21T13:32:08.995Z

Updated: 2025-08-21T13:49:58.107Z

Reserved: 2025-08-21T05:28:41.708Z

Link: CVE-2025-9301

cve-icon Vulnrichment

Updated: 2025-08-21T13:49:49.136Z

cve-icon NVD

Status : Received

Published: 2025-08-21T14:15:44.137

Modified: 2025-08-21T14:15:44.137

Link: CVE-2025-9301

cve-icon Redhat

Severity : Low

Publid Date: 2025-08-21T13:32:08Z

Links: CVE-2025-9301 - Bugzilla