CVE-2024-46993
Electron vulnerable to Heap Buffer Overflow in NativeImage
Impact
### Impact The `nativeImage.createFromPath()` and `nativeImage.createFromBuffer()` functions call a function downstream that is vulnerable to a heap buffer overflow. An Electron program that uses either of the affected functions is vulnerable to a buffer overflow if an attacker is in control of the image's height, width, and contents. ### Workaround There are no app-side workarounds for this issue. You must update your Electron version to be protected. ### Patches - `v28.3.2` - `v29.3.3` - `v30.0.3` ### For More Information If you have any questions or comments about this advisory, email us at [security@electronjs.org](mailto:security@electronjs.org).
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| npm | electron | < 28.3.2 | 28.3.2 |
Affected products
| Product | Affected versions |
|---|---|
| Versions | before 28.3.2 |
Versions were read from the advisory text. No structured product data has been published for this record yet.