CVE-2025-29768 Vim vulnerable to potential data loss with zip.vim and special crafted zip files

What is CVE-2025-29768?

CVE-2025-29768 is a medium-severity vulnerability in Netapp Bootstrap Os, published on 13 Mar 2025. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.

Official description

Vim, a text editor, is vulnerable to potential data loss with zip.vim and special crafted zip files in versions prior to 9.1.1198. The impact is medium because a user must be made to view such an archive with Vim and then press 'x' on such a strange filename. The issue has been fixed as of Vim patch v9.1.1198.

Weakness: CWE-88

Which versions are affected by CVE-2025-29768?

It affects 2 products.

Products include Netapp Bootstrap Os, Vim Vim.

How do I fix CVE-2025-29768?

Apply the vendor's patch.

Is CVE-2025-29768 being exploited?

There is no known exploitation of CVE-2025-29768 in the wild and no public exploit code.

Other vulnerabilities in Netapp Bootstrap Os

• CVE-2024-43398 REXML denial of service vulnerability Medium 5.9
• CVE-2025-30691 Security feature bypass in Oracle Java SE Medium 4.8
• CVE-2024-43790 heap-buffer-overflow in do_search() in Vim < 9.1.0689 Medium 4.5
• CVE-2024-39908 Denial of service in REXML Medium 4.3
• CVE-2024-47814 use-after-free when closing buffers in Vim Low 3.9

All Netapp Bootstrap Os vulnerabilities

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as ALPINE-CVE-2025-29768, AZL-58616, AZL-58632, BELL-CVE-2025-29768, DEBIAN-CVE-2025-29768, ECHO-650c-8906-b338 and 4 more.