CVE-2025-29768

Published: Mar 13, 2025Modified: Jun 17, 2026

4.4

Vector

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N

Exploitability: 1.8 / Impact: 2.5

Source: NVD

Description

Vim, a text editor, is vulnerable to potential data loss with zip.vim and special crafted zip files in versions prior to 9.1.1198. The impact is medium because a user must be made to view such an archive with Vim and then press 'x' on such a strange filename. The issue has been fixed as of Vim patch v9.1.1198.

Affected (2)

Products: Vim: Vim · Netapp: Bootstrap Os

1 product

1 product

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Vim Vim	Before 9.1.1198

Configuration B

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Netapp Bootstrap Os	All versions

Running on/with	Platform Versions
Netapp Hci Compute Node	All versions

Related CWEs

Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')

The product constructs a string for a command to be executed by a separate component in another control sphere, but it does not properly delimit the intended arguments, options, or switches within that command string.

References (3)

https://github.com/vim/vim/commit/f209dcd3defb95bae21b2740910e6aa7bb940531

Source: security-advisories@github.com

Patch

https://github.com/vim/vim/security/advisories/GHSA-693p-m996-3rmf

Source: security-advisories@github.com

Vendor Advisory

https://security.netapp.com/advisory/ntap-20250502-0001/

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

Timeline

No history available yet.