CVE-2024-46993 Electron Vulnerable to Heap Buffer Overflow in NativeImage::CreateFromPath
Attackers can trigger heap buffer overflows in Electron apps via crafted images, potentially leading to code execution or crashes.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2024-46993?
CVE-2024-46993 is a medium-severity memory corruption vulnerability in electron, published on 1 Jul 2025. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
Electron is an open source framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. In versions prior to 28.3.2, 29.3.3, and 30.0.3, the nativeImage.createFromPath() and nativeImage.createFromBuffer() functions call a function downstream that is vulnerable to a heap buffer overflow. An Electron program that uses either of the affected functions is vulnerable to a buffer overflow if an attacker is in control of the image's height, width, and contents. This issue has been patched in versions 28.3.2, 29.3.3, and 30.0.3. There are no workarounds for this issue.
Weakness: CWE-122
Which versions are affected by CVE-2024-46993?
6 open source packages ship an affected version, including electron.
| Package | Affected | Fixed in |
|---|---|---|
electron npm | All versions | 28.3.2 |
electron npm | All versions | 28.3.2 |
electron npm | From 29.0.0-alpha.1 | 29.3.3 |
electron npm | From 29.0.0-alpha.1 | 29.3.3 |
electron npm | From 30.0.0-alpha.1 | 30.0.3 |
electron npm | From 30.0.0-alpha.1 | 30.0.3 |
How do I fix CVE-2024-46993?
Upgrade electron to a fixed version for your release line: 28.3.2, 29.3.3 or 30.0.3.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2024-46993 being exploited?
There is no known exploitation of CVE-2024-46993 in the wild and no public exploit code.
Sources
Also known as GHSA-6r2x-8pq8-9489.