{"cve":"CVE-2024-46993","nvd":{"published":"2025-07-01T03:15:21.020","modified":"2026-06-17T07:56:19.817","status":"Deferred","description":"Electron is an open source framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. In versions prior to 28.3.2, 29.3.3, and 30.0.3, the nativeImage.createFromPath() and nativeImage.createFromBuffer() functions call a function downstream that is vulnerable to a heap buffer overflow. An Electron program that uses either of the affected functions is vulnerable to a buffer overflow if an attacker is in control of the image's height, width, and contents. This issue has been patched in versions  28.3.2, 29.3.3, and 30.0.3. There are no workarounds for this issue.","cvss_v4":{"vector":"CVSS:4.0/AV:L/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U","score":4.4},"cvss_v3":null,"cwes":["CWE-122"],"references":["https://github.com/electron/electron/security/advisories/GHSA-6r2x-8pq8-9489"],"products":[],"source":"nvd","synced_at":"2026-10-19T22:03:23.287444849+00:00"},"epss":{"cve":"CVE-2024-46993","score":0.00156,"percentile":0.04745,"date":"2026-10-31"},"kev":null,"osv":[{"id":"GHSA-6r2x-8pq8-9489","url":"https://osv.dev/vulnerability/GHSA-6r2x-8pq8-9489","summary":"Electron vulnerable to Heap Buffer Overflow in NativeImage","modified":"2025-07-01T13:13:25Z","packages":[{"ecosystem":"npm","name":"electron","purl":"pkg:npm/electron","ranges":["<28.3.2"],"fixed":["28.3.2"]},{"ecosystem":"npm","name":"electron","purl":"pkg:npm/electron","ranges":[">=29.0.0-alpha.1 <29.3.3"],"fixed":["29.3.3"]},{"ecosystem":"npm","name":"electron","purl":"pkg:npm/electron","ranges":[">=30.0.0-alpha.1 <30.0.3"],"fixed":["30.0.3"]}]}],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}