GHSA-6r2x-8pq8-9489

Source

https://github.com/advisories/GHSA-6r2x-8pq8-9489

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/06/GHSA-6r2x-8pq8-9489/GHSA-6r2x-8pq8-9489.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-6r2x-8pq8-9489

Aliases

CVE-2024-46993

Published

2025-06-30T18:41:08Z

Modified

2025-07-01T13:13:25Z

Severity

4.4 (Medium) CVSS_V4 - CVSS:4.0/AV:L/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U CVSS Calculator

Summary

Electron vulnerable to Heap Buffer Overflow in NativeImage

Details

Impact

The nativeImage.createFromPath() and nativeImage.createFromBuffer() functions call a function downstream that is vulnerable to a heap buffer overflow. An Electron program that uses either of the affected functions is vulnerable to a buffer overflow if an attacker is in control of the image's height, width, and contents.

Workaround

There are no app-side workarounds for this issue. You must update your Electron version to be protected.

Patches

v28.3.2
v29.3.3
v30.0.3

For More Information

If you have any questions or comments about this advisory, email us at security@electronjs.org.

Database specific

{
    "github_reviewed": true,
    "github_reviewed_at": "2025-06-30T18:41:08Z",
    "severity": "MODERATE",
    "nvd_published_at": "2025-07-01T03:15:21Z",
    "cwe_ids": [
        "CWE-122"
    ]
}

References

Affected packages

npm / electron

Package

Name: electron; View open source insights on deps.dev
Purl: pkg:npm/electron

Affected ranges

Type: SEMVER
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

28.3.2

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/06/GHSA-6r2x-8pq8-9489/GHSA-6r2x-8pq8-9489.json"

npm / electron

Package

Name: electron; View open source insights on deps.dev
Purl: pkg:npm/electron

Affected ranges

Type: SEMVER
Events: Introduced

29.0.0-alpha.1

Fixed

29.3.3

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/06/GHSA-6r2x-8pq8-9489/GHSA-6r2x-8pq8-9489.json"

npm / electron

Package

Name: electron; View open source insights on deps.dev
Purl: pkg:npm/electron

Affected ranges

Type: SEMVER
Events: Introduced

30.0.0-alpha.1

Fixed

30.0.3

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/06/GHSA-6r2x-8pq8-9489/GHSA-6r2x-8pq8-9489.json"