CVE-2025-9301

Name	CVE-2025-9301
Description	A vulnerability was determined in cmake 4.1.20250725-gb5cce23. This affects the function cmForEachFunctionBlocker::ReplayItems of the file cmForEachCommand.cxx. This manipulation causes reachable assertion. The attack needs to be launched locally. The exploit has been publicly disclosed and may be utilized. Patch name: 37e27f71bc356d880c908040cd0cb68fa2c371b8. It is suggested to install a patch to address this issue.
Source	CVE (at NVD; CERT, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
cmake (PTS)	bullseye	3.18.4-2+deb11u1	vulnerable
	bookworm	3.25.1-1	vulnerable
	trixie	3.31.6-2	vulnerable
	forky, sid	4.1.1+really3.31.6-1	vulnerable

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Urgency	Origin	Debian Bugs
cmake	source	(unstable)	(unfixed)	unimportant

Notes

https://gitlab.kitware.com/cmake/cmake/-/issues/27135
Fixed by: https://gitlab.kitware.com/cmake/cmake/-/commit/37e27f71bc356d880c908040cd0cb68fa2c371b8
Negligible security impact