CVE-2026-54257 Electron: Buffer performs incorrect byte length calculations resulting in heap buffer under/overflow
Incorrect byte length calculations in Electron's Buffer API can cause heap buffer overflows, leading to application crashes or potential code execution.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-54257?
CVE-2026-54257 is a critical memory corruption vulnerability in electron, published on 23 Jun 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. From 42.3.1 until 42.3.3, Buffer performs incorrect byte length calculations resulting in heap buffer under/overflow. Most apps will crash and some may perform incorrect buffer allocations in the Node.js Buffer API resulting in unexpected truncation or allocation. This vulnerability is fixed in 42.3.3.
Weakness: CWE-120
Which versions are affected by CVE-2026-54257?
2 open source packages ship an affected version, including electron.
| Package | Affected | Fixed in |
|---|---|---|
electron npm | From 42.3.1 | 42.3.3 |
electron npm | From 42.3.1 | 42.3.3 |
How do I fix CVE-2026-54257?
Upgrade electron to 42.3.3 or later.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2026-54257 being exploited?
There is no known exploitation of CVE-2026-54257 in the wild and no public exploit code.
Sources
Also known as GHSA-q6m5-f73j-m9mc.