Description
A vulnerability was determined in cmake 4.1.20250725-gb5cce23. This affects the function cmForEachFunctionBlocker::ReplayItems of the file cmForEachCommand.cxx. This manipulation causes reachable assertion. The attack needs to be launched locally. The exploit has been publicly disclosed and may be utilized. Patch name: 37e27f71bc356d880c908040cd0cb68fa2c371b8. It is suggested to install a patch to address this issue.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| — | cmake | 4.1.20250725-gb5cce23 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | cmake | No fix yet | — |
| Debian 13 | cmake | No fix yet | — |
| Debian 12 | cmake | No fix yet | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 26.10 | cmake | No fix yet | — |
| Ubuntu 26.04 LTS | cmake | No fix yet | — |
| Ubuntu 25.10 | cmake | No fix yet | — |
| Ubuntu 24.04 LTS | cmake | No fix yet | — |
| Ubuntu 22.04 LTS | cmake | No fix yet | — |
Show 3 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 20.04 LTS | cmake | No fix yet | — |
| Ubuntu 18.04 LTS | cmake | No fix yet | — |
| Ubuntu 16.04 LTS | cmake | No fix yet | — |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 15 SP7 | cmake +1 | 3.28.3-150600.3.3.1 | SUSE-SU-2025:3812-1 |
| SLES 15 SP6 | cmake +1 | 3.28.3-150600.3.3.1 | SUSE-SU-2025:3812-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Leap 15.6 | cmake +2 | 3.28.3-150600.3.3.1 | SUSE-SU-2025:3812-1 |
| openSUSE Leap 15.6 | cmake3 +1 | 3.20.0-150200.6.6.1 | SUSE-SU-2025:02975-1 |
| openSUSE Leap 15.6 | cmake3-ui | 3.17.0-150000.1.9.1 | SUSE-SU-2025:02976-1 |
Azure Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Azure Linux 3 | cmake | 3.30.3-9 | — |
| Azure Linux 2 (CBL-Mariner) | cmake | 3.21.4-19 | — |
Advisories 4
- WID-SEC-2026-1730 Xerox FreeFlow Print Server: Mehrere Schwachstellen ermöglichen nicht spezifizierten Angriff BSI CERT-Bund (WID) · Jul 16, 2026
- SUSE-SU-2025:3812-1 Security update for cmake SUSE / openSUSE Security Updates · Mar 23, 2026
- SUSE-SU-2025:02976-1 Security update for cmake3 SUSE / openSUSE Security Updates · Mar 23, 2026
- SUSE-SU-2025:02975-1 Security update for cmake3 SUSE / openSUSE Security Updates · Mar 23, 2026
References
- VDB-320906 | cmake cmForEachCommand.cxx ReplayItems assertion vdb-entry technical-description
- VDB-320906 | CTI Indicators (IOB, IOC, IOA) signature permissions-required
- Submit #632369 | cmake 4.1.20250725-gb5cce23 and other recent versions of the 4.x series. assertion failure third-party-advisory
- https://gitlab.kitware.com/cmake/cmake/-/issues/27135 issue-tracking
- https://gitlab.kitware.com/cmake/cmake/-/issues/27135#note_1691629 issue-tracking
- https://drive.google.com/file/d/1TerUqQB8_lzJTwIBCBmE94zn7n-gOz4f/view?usp=sharing exploit
- https://gitlab.kitware.com/cmake/cmake/-/commit/37e27f71bc356d880c908040cd0cb68fa2c371b8 patch