CVE-2024-46993
MEDIUM EPSS 2.6%
Published Jul 1, 20251y ago · Modified Jun 17, 20262w ago
4.4 CVSS 4.0
Published Jul 1, 2025 1y ago
Last Modified Jun 17, 2026 2w ago
Description
Electron is an open source framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. In versions prior to 28.3.2, 29.3.3, and 30.0.3, the nativeImage.createFromPath() and nativeImage.createFromBuffer() functions call a function downstream that is vulnerable to a heap buffer overflow. An Electron program that uses either of the affected functions is vulnerable to a buffer overflow if an attacker is in control of the image's height, width, and contents. This issue has been patched in versions 28.3.2, 29.3.3, and 30.0.3. There are no workarounds for this issue.
CVSS Details
Base Score
Exploitability
Impact
Vector string
CVSS:4.0/AV:L/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Attack Vector Local
Attack Complexity High
Privileges Required Low
User Interaction None
Scope X
Threat Intelligence
EPSS Exploit Probability
2.6% percentile
Exploit & Patch Status
No Known Exploit
No Patch Available
Weaknesses 1
CWE-122
References 1
- github.com https://github.com/electron/electron/security/advisories/GHSA-6r2x-8pq8-9489
Remediation
No remediation data recorded yet
Check vendor advisories and the NVD entry for patch availability.