Medium severity · published Jul 1, 2025
CVE-2024-46993
Electron Vulnerable to Heap Buffer Overflow in NativeImage::CreateFromPath
4.4
CVSS
0.2%
EPSS
No
On KEV
Description
Electron is an open source framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. In versions prior to 28.3.2, 29.3.3, and 30.0.3, the nativeImage.createFromPath() and nativeImage.createFromBuffer() functions call a function downstream that is vulnerable to a heap buffer overflow. An Electron program that uses either of the affected functions is vulnerable to a buffer overflow if an attacker is in control of the image's height, width, and contents. This issue has been patched in versions 28.3.2, 29.3.3, and 30.0.3. There are no workarounds for this issue.
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 5% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
EL
electron · electron
< 28.3.2; >= 29.0.0-alpha.1, < 29.3.3; >= 30.0.0-alpha.1, < 30.0.3 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2024-46993
CVE.org
https://www.cve.org/CVERecord?id=CVE-2024-46993
github.com
https://github.com/electron/electron/security/advisories/GHSA-6r2x-8pq8-9489
More from electron
9.8
CVE-2026-102676
Electron: <webview> can enable Node.js integration in Web Workers despite embedder restrictions
9.8
CVE-2026-34775
Electron: nodeIntegrationInWorker not correctly scoped in shared renderer processes
9.8
CVE-2023-23623
Content-Secrity-Policy disabling eval not applied consistently in renderers with sandbox disabled in Electron
9.3
CVE-2026-54257
Electron: Buffer performs incorrect byte length calculations resulting in heap buffer under/overflow
8.8
CVE-2026-102677
Electron: Sandboxed preload code cache can be poisoned by a compromised renderer