Heap-based Buffer Overflow Affecting electron package, versions <28.3.2>=29.0.0-alpha.1 <29.3.3>=30.0.0-alpha.1 <30.0.3
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk IDSNYK-JS-ELECTRON-10568318
- published1 Jul 2025
- disclosed1 Jul 2025
- creditFranco Belman
Introduced: 1 Jul 2025
NewCVE-2024-46993 (opens in a new tab)Common Vulnerabilities and Exposures (CVE) are common identifiers for publicly known security vulnerabilities
Common Weakness Enumeration (CWE) is a category system for software weaknesses
How to fix?
Upgrade electron to version 28.3.2, 29.3.3, 30.0.3 or higher.
Overview
electron is a framework which lets you write cross-platform desktop applications using JavaScript, HTML and CSS.
Affected versions of this package are vulnerable to Heap-based Buffer Overflow. The nativeImage.createFromPath or nativeImage.createFromBuffer APIs in Electron, which make use of Chromium's JPEGCodec::Decode, are vulnerable to a heap-based buffer overflow. An attacker can execute arbitrary code or cause a crash by supplying specially crafted image data.