CVE-2025-29768
📋 TL;DR
Vim versions before 9.1.1198 contain a vulnerability in zip.vim that could cause data loss when users view specially crafted zip files and press 'x' on unusual filenames. This affects users who open zip archives with Vim's built-in zip file handler. The risk is limited to local users who interact with malicious archives.
💻 Affected Systems
- Vim
📦 What is this software?
Vim by Vim
⚠️ Risk & Real-World Impact
Worst Case
User accidentally extracts or deletes files from a malicious zip archive, causing unintended data loss or corruption of local files.
Likely Case
Minimal impact since it requires user interaction with a specially crafted zip file and pressing 'x' on specific filenames - most users would avoid this interaction.
If Mitigated
No impact if users don't open untrusted zip files with Vim or have patched to version 9.1.1198 or later.
🎯 Exploit Status
Exploitation requires user interaction: opening a malicious zip file in Vim and pressing 'x' on specific filenames. No known active exploitation.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 9.1.1198
Vendor Advisory: https://github.com/vim/vim/security/advisories/GHSA-693p-m996-3rmf
Restart Required: No
Instructions:
1. Update Vim to version 9.1.1198 or later. 2. For package managers: 'sudo apt update && sudo apt upgrade vim' (Debian/Ubuntu) or 'sudo yum update vim' (RHEL/CentOS). 3. For source builds: pull latest from https://github.com/vim/vim and rebuild.
🔧 Temporary Workarounds
Disable zip.vim plugin
allPrevent Vim from handling zip files by disabling the zip.vim plugin
Add 'let g:loaded_zipPlugin = 1' to your .vimrc file
Avoid opening zip files with Vim
allUse dedicated archive tools instead of Vim for zip files
🧯 If You Can't Patch
- Train users to avoid opening untrusted zip files with Vim
- Implement file integrity monitoring to detect unexpected file deletions
🔍 How to Verify
Check if Vulnerable:
Check Vim version with 'vim --version' and verify it's below 9.1.1198Check Version:
vim --version | grep '^VIM'Verify Fix Applied:
Confirm version is 9.1.1198 or higher with 'vim --version | head -1'📡 Detection & Monitoring
Log Indicators:
- Unusual file deletion events in system logs
- Vim process accessing zip files
Network Indicators:
- None - this is a local file handling vulnerability
SIEM Query:
Process execution where process_name='vim' AND command_line CONTAINS '.zip'