Executive brief
Electron, a widely-used framework for building desktop applications, uses the libvpx video encoding library which contains a heap buffer overflow vulnerability in VP8 encoding. An attacker can exploit this flaw by sending a specially crafted HTML page containing malicious video content, potentially allowing arbitrary code execution on a user's system.
Technical details
This is a heap buffer overflow vulnerability (CWE-787) in libvpx's VP8 encoding implementation, inherited by Electron which bundles the library. The vulnerability exists when handling malformed VP8-encoded video streams within web pages. An attacker can trigger heap corruption by crafting a malicious HTML page containing adversarial video content; this requires user interaction (loading or viewing the page in an Electron app) but no authentication. Successful exploitation can lead to arbitrary code execution with the privileges of the Electron application. Patches are available in Electron 22.3.25, 24.8.5, 25.8.4, 26.2.4, and 27.0.0-beta.8 or later, which update libvpx to version 1.13.1 or incorporate the necessary commit patches.
Affected products
- OpenJS Foundation Electron versions prior to 22.3.25, 24.x prior to 24.8.5, 25.x prior to 25.8.4, 26.x prior to 26.2.4, and 27.x prior to 27.0.0-beta.8
Timeline
- 2023-09-28: disclosed
- 2023-09-28: patched: Electron patches released for multiple versions