CVE-2024-46993

Katalog CVE

CVSS 4.4 · Medium EPSS 0,16%

Kerentanan Heap-based Buffer Overflow. Skor CVSS 4.0 4.4 (Medium) menurut github.com.

Deskripsi (NVD)

Electron is an open source framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. In versions prior to 28.3.2, 29.3.3, and 30.0.3, the nativeImage.createFromPath() and nativeImage.createFromBuffer() functions call a function downstream that is vulnerable to a heap buffer overflow. An Electron program that uses either of the affected functions is vulnerable to a buffer overflow if an attacker is in control of the image's height, width, and contents. This issue has been patched in versions 28.3.2, 29.3.3, and 30.0.3. There are no workarounds for this issue.

Rincian

Terbit di NVD

1 Juli 2025

Terakhir diubah

17 Juni 2026

Status NVD

Deferred

CVSS 4.0

4.4 (Medium), sumber github.com
CVSS:4.0/AV:L/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-122: Heap-based Buffer Overflow

EPSS (30 hari)

0,16% peluang dieksploitasi; lebih tinggi dari 4,2% CVE lain

Produk dan versi terdampak

NVD belum mencantumkan data produk (CPE) untuk CVE ini. Produk yang terdampak biasanya disebut di deskripsi dan di advisory vendor pada daftar referensi.

Referensi dan perbaikan

• https://github.com/electron/electron/security/advisories/GHSA-6r2x-8pq8-9489