Packages / electron / Security

ModerateVulnerabilityGHSA-6r2x-8pq8-9489CVE-2024-46993Published 30 Jun 2025

Electron vulnerable to Heap Buffer Overflow in NativeImage

Affected releases · electron

  • 30.x30.0.0 – 30.0.2Fixed in 30.0.3
  • 29.x29.0.0 – 29.3.2Fixed in 29.3.3
  • 28.x28.0.0 – 28.3.1Fixed in 28.3.2
  • 27.x and older0.1.0 – 27.3.11No fix, no longer updated

On 30.x, the newest line:

npm install electron@30.0.3
45.x

  1. Not affected

    45.0.0

    1 release, latest

30.x

  1. Affected

    30.0.0 – 30.0.2

    3 releases

  2. Fixed

    30.0.3 – 30.5.1

    16 releases

29.x

  1. Affected

    29.0.0 – 29.3.2

    13 releases

  2. Fixed

    29.3.3 – 29.4.6

    7 releases

28.x

  1. Affected

    28.0.0 – 28.3.1

    19 releases

  2. Fixed

    28.3.2 – 28.3.3

    2 releases

27.x

  1. Affected

    27.0.0 – 27.3.11

    25 releases

26.x

  1. Affected

    26.0.0 – 26.6.10

    24 releases

25.x

  1. Affected

    25.0.0 – 25.9.8

    26 releases

24.x

  1. Affected

    24.0.0 – 24.8.8

    29 releases

23.x

  1. Affected

    23.0.0 – 23.3.13

    25 releases

22.x

  1. Affected

    22.0.0 – 22.3.27

    33 releases

21.x

  1. Affected

    21.0.0 – 21.4.4

    18 releases

20.x

  1. Affected

    20.0.0 – 20.3.12

    23 releases

19.x

  1. Affected

    19.0.0 – 19.1.9

    28 releases

18.x

  1. Affected

    18.0.0 – 18.3.15

    25 releases

17.x

  1. Affected

    17.0.0 – 17.4.11

    20 releases

16.x

  1. Affected

    16.0.0 – 16.2.8

    22 releases

15.x

  1. Affected

    15.0.0 – 15.5.7

    24 releases

14.x

  1. Affected

    14.0.0 – 14.2.9

    15 releases

13.x

  1. Affected

    13.0.0 – 13.6.9

    29 releases

12.x

  1. Affected

    12.0.0 – 12.2.3

    26 releases

11.x

  1. Affected

    11.0.0 – 11.5.0

    27 releases

10.x

  1. Affected

    10.0.0 – 10.4.7

    22 releases

9.x

  1. Affected

    9.0.0 – 9.4.4

    22 releases

8.x

  1. Affected

    8.0.0 – 8.5.5

    25 releases

7.x

  1. Affected

    7.0.0 – 7.3.3

    26 releases

6.x

  1. Affected

    6.0.0 – 6.1.12

    26 releases

5.x

  1. Affected

    5.0.0 – 5.0.13

    14 releases

4.x

  1. Affected

    4.0.0 – 4.2.12

    28 releases

3.x

  1. Affected

    3.0.0 – 3.1.13

    31 releases

2.x

  1. Affected

    2.0.0 – 2.0.18

    19 releases

1.x

  1. Affected

    1.3.1 – 1.8.8

    79 releases

0.x

  1. Affected

    0.1.0 – 0.4.1

    8 releases

1131 stable releases of electron, oldest to newest, one row per major.

Is your project affected?

Paste your package.json, or type the range you declare for electron. It is read in your browser and sent nowhere.

What happens

Impact

The nativeImage.createFromPath() and nativeImage.createFromBuffer() functions call a function downstream that is vulnerable to a heap buffer overflow. An Electron program that uses either of the affected functions is vulnerable to a buffer overflow if an attacker is in control of the image's height, width, and contents.

Workaround

There are no app-side workarounds for this issue. You must update your Electron version to be protected.

Patches

  • v28.3.2

  • v29.3.3

  • v30.0.3

For More Information

If you have any questions or comments about this advisory, email us at security@electronjs.org.