CVE-2024-46993 – electron

Package

Manager: npm
Name: electron
Vulnerable Version: >=0 <28.3.2 || >=29.0.0-alpha.1 <29.3.3 || >=30.0.0-alpha.1 <30.0.3

Severity

Level: Medium

CVSS v3.1: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N/E:U/RL:O/RC:C

CVSS v4.0: CVSS:4.0/AV:L/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U

EPSS: 0.00021 pctl0.04007

Details

Electron vulnerable to Heap Buffer Overflow in NativeImage ### Impact The `nativeImage.createFromPath()` and `nativeImage.createFromBuffer()` functions call a function downstream that is vulnerable to a heap buffer overflow. An Electron program that uses either of the affected functions is vulnerable to a buffer overflow if an attacker is in control of the image's height, width, and contents. ### Workaround There are no app-side workarounds for this issue. You must update your Electron version to be protected. ### Patches - `v28.3.2` - `v29.3.3` - `v30.0.3` ### For More Information If you have any questions or comments about this advisory, email us at [security@electronjs.org](mailto:security@electronjs.org).

Metadata

Created: 2025-06-30T18:41:08Z
Modified: 2025-07-01T13:13:25Z
Source: https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/06/GHSA-6r2x-8pq8-9489/GHSA-6r2x-8pq8-9489.json
CWE IDs: ["CWE-122"]
Alternative ID: GHSA-6r2x-8pq8-9489
Finding: F184
Auto approve: 1