CVE-2025-9301

What it actually does

The flaw triggers a reachable assertion in cmForEachFunctionBlocker::ReplayItems within cmForEachCommand.cxx when processing specially crafted input, causing the cmake process to terminate.

Why it matters to the business

Build and configuration workflows using cmake can be interrupted locally, leading to failed automation, delayed software releases, and wasted developer time on repeated attempts.

How an attack unfolds

An attacker with local access supplies a malicious CMakeLists.txt or input file that reaches the ReplayItems function, forcing the assertion failure and crashing the cmake invocation; the issue is public and the patch commit is known.

How to fix it

Upgrade cmake to the fixed commit 37e27f71bc356d880c908040cd0cb68fa2c371b8 or apply the corresponding patch; for affected Chainguard packages update to 0.53.0-r1.

How to confirm the fix worked

Confirm the installed cmake binary reports a version containing commit 37e27f71bc356d880c908040cd0cb68fa2c371b8 and test that previously crashing inputs no longer trigger assertions.

Typical attack path

1. Obtain local access to a system with the vulnerable cmake binary
2. Craft a CMakeLists.txt containing input that exercises the cmForEachCommand path
3. Invoke cmake on the crafted file to trigger the reachable assertion
4. Observe process termination and denial of service

How to detect it

Review build server logs and process crash reports for cmake terminations around the time of suspected activity; look for repeated failed cmake invocations on user-supplied files.

What your security team should do

• Apply the patch or upgrade to the listed fixed versions immediately on all build systems
• Scan repositories and CI pipelines for use of the vulnerable cmake versions
• Monitor build logs for unexpected cmake crashes or assertion failures