https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-20T08:11:59.960398+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/bdu:2025-11357 bdu:2025-11357 2026-10-20T08:11:59.962997+00:00 bdu:2025-11357 https://cve.radiocsirt.org/vuln/euvd-2026-246318 EUVD-2026-246318 2026-10-20T08:11:59.963039+00:00 EUVD-2026-246318 https://cve.radiocsirt.org/vuln/fkie_cve-2024-46993 fkie_cve-2024-46993 2026-10-20T08:11:59.963054+00:00

Electron is an open source framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. In versions prior to 28.3.2, 29.3.3, and 30.0.3, the nativeImage.createFromPath() and nativeImage.createFromBuffer() functions call a function downstream that is vulnerable to a heap buffer overflow. An Electron program that uses either of the affected functions is vulnerable to a buffer overflow if an attacker is in control of the image's height, width, and contents. This issue has been patched in versions 28.3.2, 29.3.3, and 30.0.3. There are no workarounds for this issue.

 https://cve.radiocsirt.org/vuln/ghsa-6r2x-8pq8-9489 GHSA-6r2x-8pq8-9489 — Electron vulnerable to Heap Buffer Overflow in NativeImage 2026-10-20T08:11:59.963087+00:00

Affected: npm: electron

### Impact The `nativeImage.createFromPath()` and `nativeImage.createFromBuffer()` functions call a function downstream that is vulnerable to a heap buffer overflow. An Electron program that uses either of the affected functions is vulnerable to a buffer overflow if an attacker is in control of the image's height, width, and contents.

### Workaround There are no app-side workarounds for this issue. You must update your Electron version to be protected.

### Patches

- `v28.3.2` - `v29.3.3` - `v30.0.3`

### For More Information

If you have any questions or comments about this advisory, email us at [security@electronjs.org](mailto:security@electronjs.org).