CVE-2025-9301 — Reachable Assertion in Cmake

CWE-617 — Reachable Assertion6 documents6 sources
Severity
4.8MEDIUMNVD
EPSS
0.0%
top 96.80%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
5
Debian CmakeMsrc Azl3 Cmake 3.30.3-8 ON Azure Linux 3.0Msrc Azl3 Cmake 3.30.3-9 ON Azure Linux 3.0+2 more
Timeline
PublishedAug 21

Description

A vulnerability was determined in cmake 4.1.20250725-gb5cce23. This affects the function cmForEachFunctionBlocker::ReplayItems of the file cmForEachCommand.cxx. This manipulation causes reachable assertion. The attack needs to be launched locally. The exploit has been publicly disclosed and may be utilized. Patch name: 37e27f71bc356d880c908040cd0cb68fa2c371b8. It is suggested to install a patch to address this issue.

CVSS vector

CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N

Affected Packages5 packages

▶debiandebian/cmake

🔴Vulnerability Details

2
OSV
CVE-2025-9301: A vulnerability was determined in cmake 4↗2025-08-21
▶
GHSA
GHSA-mff3-m38v-mgv6: A vulnerability was determined in cmake 4↗2025-08-21
▶

📋Vendor Advisories

3
Red Hat
cmake: cmake reachable assertion↗2025-08-21
▶
Microsoft
cmake cmForEachCommand.cxx ReplayItems assertion↗2025-08-12
▶
Debian
CVE-2025-9301: cmake - A vulnerability was determined in cmake 4.1.20250725-gb5cce23. This affects the ...↗2025
▶