~ / search / GHSA-6r2x-8pq8-9489

GHSA-6r2x-8pq8-9489

Electron vulnerable to Heap Buffer Overflow in NativeImage

Source: GitHub Advisory Database (reviewed) Moderate CVE-2024-46993

Packages

EcosystemPackageAffectedFixed in
npm electron < 28.3.2 28.3.2
npm electron >= 29.0.0-alpha.1, < 29.3.3 29.3.3
npm electron >= 30.0.0-alpha.1, < 30.0.3 30.0.3

Details

As written in the advisory (Markdown source, shown as plain text).

### Impact The `nativeImage.createFromPath()` and `nativeImage.createFromBuffer()` functions call a function downstream that is vulnerable to a heap buffer overflow. An Electron program that uses either of the affected functions is vulnerable to a buffer overflow if an attacker is in control of the image's height, width, and contents. ### Workaround There are no app-side workarounds for this issue. You must update your Electron version to be protected. ### Patches - `v28.3.2` - `v29.3.3` - `v30.0.3` ### For More Information If you have any questions or comments about this advisory, email us at [[email protected]](mailto:[email protected]).

References

External links from the advisory. They lead to third-party sites.