Reachable assertion in CMake - CVE-2025-9301

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU114433

Reachable assertion in CMake - CVE-2025-9301

Published: August 26, 2025


Vulnerability identifier: #VU114433
CSH Severity: Low
CVSS v4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2025-9301
CWE-ID: CWE-617
Exploitation vector: Local access
Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to a reachable assertion within the mForEachFunctionBlocker::ReplayItems() function in cmForEachCommand.cxx. A local user can perform a denial of service (DoS) attack.


Affected software

CMake
SUSE Linux Enterprise Server for SAP Applications 15
SUSE Linux Enterprise Server 15
SUSE Linux Enterprise Real Time 15
SUSE Linux Enterprise Desktop 15
Basesystem Module
openSUSE Leap
openEuler
Anolis OS
Fedora
cmake3-ui-debugsource
cmake3-full-debuginfo
cmake3-full-debugsource
cmake3-full
cmake3
cmake
cmake-man
cmake-mini-debugsource
cmake-full-debugsource
cmake-mini
cmake-mini-debuginfo
cmake-full-debuginfo
cmake-gui
cmake-full
cmake-gui-debuginfo
cmake-ui-debugsource
cmake-rpm-macros
cmake-help
cmake-data
cmake-filesystem
cmake-doc

How to mitigate CVE-2025-9301

Install updates from vendor's website.

cmake3-ui-debugsource - update to 3.17.0-150000.1.9.1
cmake3-full-debuginfo - update to 3.20.0-150200.6.6.1
cmake3-full-debugsource - update to 3.20.0-150200.6.6.1
cmake3-full - update to 3.20.0-150200.6.6.1
cmake3 - update to 3.20.0-150200.6.6.1
cmake - addressed in versions 3.20.4-150400.4.9.1, 3.28.3-150600.3.3.1
cmake-man - addressed in versions 3.20.4-150400.4.9.1, 3.28.3-150600.3.3.1
cmake-mini-debugsource - addressed in versions 3.20.4-150400.4.9.1, 3.28.3-150600.3.3.1
cmake-full-debugsource - addressed in versions 3.20.4-150400.4.9.1, 3.28.3-150600.3.3.1
cmake-mini - addressed in versions 3.20.4-150400.4.9.1, 3.28.3-150600.3.3.1
cmake-mini-debuginfo - addressed in versions 3.20.4-150400.4.9.1, 3.28.3-150600.3.3.1
cmake-full-debuginfo - addressed in versions 3.20.4-150400.4.9.1, 3.28.3-150600.3.3.1
cmake-gui - addressed in versions 3.20.4-150400.4.9.1, 3.28.3-150600.3.3.1
cmake-full - addressed in versions 3.20.4-150400.4.9.1, 3.28.3-150600.3.3.1
cmake-gui-debuginfo - addressed in versions 3.20.4-150400.4.9.1, 3.28.3-150600.3.3.1
cmake-ui-debugsource - addressed in versions 3.20.4-150400.4.9.1, 3.28.3-150600.3.3.1
cmake - addressed in versions 3.22.0-11, 3.27.9-7, 3.27.9-8
cmake-rpm-macros - addressed in versions 3.22.0-11, 3.27.9-7, 3.27.9-8
cmake-help - addressed in versions 3.22.0-11, 3.27.9-7, 3.27.9-8
cmake-data - addressed in versions 3.22.0-11, 3.27.9-7, 3.27.9-8
cmake-gui - addressed in versions 3.22.0-11, 3.27.9-7, 3.27.9-8
cmake-filesystem - addressed in versions 3.22.0-11, 3.27.9-7, 3.27.9-8
cmake-gui - update to 3.30.5-3
cmake-rpm-macros - update to 3.30.5-3
cmake-doc - update to 3.30.5-3
cmake-data - update to 3.30.5-3
cmake-filesystem - update to 3.30.5-3
cmake - update to 3.30.5-3
cmake - addressed in versions 3.31.11-1.fc42, 3.31.11-1.fc43

External References

Related Security Bulletins