Loading...
Skip to main content
GeekWala

CVE-2026-54257 — Vulnerability in electron — CVE Details

CRITICAL

Electron: Buffer performs incorrect byte length calculations resulting in heap buffer under/overflow

Published June 15, 2026Updated July 20, 2026Source: osv

Summary

### Impact Most apps will crash and some may perform incorrect buffer allocations in the Node.js `Buffer` API resulting in unexpected truncation or allocation. ### Workarounds No workarounds. Do not use these impacted Electron releases ### Fixed Versions * `42.3.3` ### For more information If you have any questions or comments about this advisory, email us at [security@electronjs.org](mailto:security@electronjs.org)

Advisory Timeline

  • First published June 15, 2026 (119 days ago).
  • Last revised July 20, 2026 — 35 days after initial publication.

Remediation

Upgrade to the fixed version using your package manager.

npm
Update electron to 42.3.3 or later
npm install electron@42.3.3

After upgrading, run your dependency scanner again to confirm the vulnerability is resolved.

Affected Packages (1)

Affects 1 ecosystem: npm (1).

PackageEcosystemAffectedFixed In
electron
npm
All versions42.3.3

Vulnerability Classification

Common Weakness Enumeration (CWE) identifiers for this vulnerability type.

  • CWE-120
    Buffer Copy Without Checking SizeMITRE

CVSS Score Breakdown

What the CVSS (Common Vulnerability Scoring System) 9.8 score means for each attack dimension.

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
—
Confidentiality
—
Integrity
—
Availability
—

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

References

Frequently Asked Questions

What is CVE-2026-54257?
Electron: Buffer performs incorrect byte length calculations resulting in heap buffer under/overflow This vulnerability has been assigned a severity rating of CRITICAL (CVSS score: 9.8/10).
How do I check if my project is affected by CVE-2026-54257?
CVE-2026-54257 affects electron. Use GeekWala's free vulnerability scanner to check your dependencies against CVE-2026-54257 and 200,000+ other known vulnerabilities.

Severity & Exploitability

CVSS Score
9.8

Exploitation is straightforward and causes maximum impact. Patch immediately.

Also Known As

GHSA-q6m5-f73j-m9mc

Related CVEs

  • CVE-2026-107722
    CRITICAL

    fast-jwt: Incomplete patch of CVE-2026-34950: Non-whitespace key-prefix re-enables RSA→HS256 algorithm confusion

  • CVE-2026-108261
    CRITICAL

    TinaCMS admin preview iframe loads an attacker-controlled origin from the URL fragment

  • CVE-2026-102676
    HIGH

    Electron: <webview> can enable Node.js integration in Web Workers despite embedder restrictions

  • CVE-2026-102674
    HIGH

    Electron: Windows opened from a sandboxed top-level document do not inherit its sandbox restrictions

  • CVE-2026-102673
    HIGH

    Electron drops inherited HTML sandbox restrictions for popups opened through OpenURLFromTab

  • CVE-2023-4863
    HIGH

    libwebp: OOB write in BuildHuffmanTable

  • CVE-2026-34780
    HIGH

    Electron: Context Isolation bypass via contextBridge VideoFrame transfer

More npm advisories

Check if you're affected

Scan your dependencies to see if this vulnerability affects your projects.

Scan Your Dependencies