OESA-2025-2254 (CVE-2025-9301)
Vulnerability from osv_openeuler – Published: 2025-09-12 11:09 – Updated: 2026-08-06 11:09 – Source websiteCMake is used to control the software compilation process using simple platform and compiler independent configuration files. CMake generates native makefiles and workspaces that can be used in the compiler environment of your choice. CMake is quite sophisticated: it is possible to support complex environments requiring system configuration, preprocessor generation, code generation, and template instantiation.
Security Fix(es):
A vulnerability was identified in cmake version 4.1.20250725-gb5cce23, affecting the cmForEachFunctionBlocker::ReplayItems function in the cmForEachCommand.cxx file. This vulnerability can lead to a reachable assertion error and requires local access to exploit. The exploit details have been publicly disclosed and may be utilized. It is recommended to apply patch 37e27f71bc356d880c908040cd0cb68fa2c371b8 to mitigate this issue.(CVE-2025-9301)
| URL | Type | |
|---|---|---|
{
"affected": [
{
"ecosystem_specific": {
"aarch64": [
"cmake-3.27.9-7.oe2403.aarch64.rpm",
"cmake-filesystem-3.27.9-7.oe2403.aarch64.rpm",
"cmake-gui-3.27.9-7.oe2403.aarch64.rpm"
],
"noarch": [
"cmake-data-3.27.9-7.oe2403.noarch.rpm",
"cmake-help-3.27.9-7.oe2403.noarch.rpm",
"cmake-rpm-macros-3.27.9-7.oe2403.noarch.rpm"
],
"src": [
"cmake-3.27.9-7.oe2403.src.rpm"
],
"x86_64": [
"cmake-3.27.9-7.oe2403.x86_64.rpm",
"cmake-filesystem-3.27.9-7.oe2403.x86_64.rpm",
"cmake-gui-3.27.9-7.oe2403.x86_64.rpm"
]
},
"package": {
"ecosystem": "openEuler:24.03-LTS",
"name": "cmake",
"purl": "pkg:rpm/openEuler/cmake\u0026distro=openEuler-24.03-LTS"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "3.27.9-7.oe2403"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"database_specific": {
"severity": "Low"
},
"details": "CMake is used to control the software compilation process using simple platform and compiler independent configuration files. CMake generates native makefiles and workspaces that can be used in the compiler environment of your choice. CMake is quite sophisticated: it is possible to support complex environments requiring system configuration, preprocessor generation, code generation, and template instantiation.\r\n\r\nSecurity Fix(es):\n\nA vulnerability was identified in cmake version 4.1.20250725-gb5cce23, affecting the cmForEachFunctionBlocker::ReplayItems function in the cmForEachCommand.cxx file. This vulnerability can lead to a reachable assertion error and requires local access to exploit. The exploit details have been publicly disclosed and may be utilized. It is recommended to apply patch 37e27f71bc356d880c908040cd0cb68fa2c371b8 to mitigate this issue.(CVE-2025-9301)",
"id": "OESA-2025-2254",
"modified": "2026-08-06T11:09:19Z",
"published": "2025-09-12T11:09:19Z",
"references": [
{
"type": "ADVISORY",
"url": "https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2025-2254"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-9301"
}
],
"schema_version": "1.7.2",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L",
"type": "CVSS_V3"
}
],
"summary": "cmake security update",
"upstream": [
"CVE-2025-9301"
]
}
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
Related by attack behaviour
Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.