Heap Buffer Overflow in Electron Framework Affects Multiple Versions
CVE-2024-46993
4.4MEDIUM
What is CVE-2024-46993?
The Electron framework, utilized for building cross-platform desktop applications with web technologies, contains a vulnerability associated with the nativeImage.createFromPath() and nativeImage.createFromBuffer() methods. In affected versions, prior to 28.3.2, 29.3.3, and 30.0.3, these functions can lead to a heap buffer overflow when an attacker manipulates the height, width, and contents of an image. This flaw enables potential exploitation by malicious actors, as there are no available workarounds. Users are advised to update to the latest versions to mitigate the risk.
Affected Version(s)
electron < 28.3.2 < 28.3.2
electron >= 29.0.0-alpha.1, < 29.3.3 < 29.0.0-alpha.1, 29.3.3
electron >= 30.0.0-alpha.1, < 30.0.3 < 30.0.0-alpha.1, 30.0.3