GitHub Advisoryadvisory · npm

GHSA-6r2x-8pq8-9489 Electron vulnerable to Heap Buffer Overflow in NativeImage

MEDIUM Published 2025-06-30 Modified 2025-07-01 Official page ↗
Aliases
CVE-2024-46993
Ecosystem
npm
Packages
electron
Severity
Moderate
CVSS vector
CVSS:4.0/AV:L/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U
Weaknesses
CWE-122
Reviewed
2025-06-30

Affected packages

• npm electron: < 28.3.2 → fixed in 28.3.2 • npm electron: >= 29.0.0-alpha.1, < 29.3.3 → fixed in 29.3.3 • npm electron: >= 30.0.0-alpha.1, < 30.0.3 → fixed in 30.0.3

Description

Impact The `nativeImage.createFromPath()` and `nativeImage.createFromBuffer()` functions call a function downstream that is vulnerable to a heap buffer overflow. An Electron program that uses either of the affected functions is vulnerable to a buffer overflow if an attacker is in control of the image's height, width, and contents. Workaround There are no app-side workarounds for this issue. You must update your Electron version to be protected. Patches • `v28.3.2` • `v29.3.3` • `v30.0.3` For More Information If you have any questions or comments about this advisory, email us at [email protected].

Related

Alias · CVE (1)

  • CVE-2024-46993 Electron is an open source framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. vulnerability

Weakness · CWE (1)

  • CWE-122 Heap-based Buffer Overflow weakness

References