Executive brief
Electron is a framework used to build desktop applications using web technologies. The vulnerability affects the nativeImage.createFromPath() and nativeImage.createFromBuffer() functions, which process image files. An attacker who can control an image file's height, width, and contents could trigger a heap buffer overflow, potentially allowing arbitrary code execution or data disclosure.
Technical details
A heap buffer overflow exists in Electron's NativeImage::CreateFromPath function. The vulnerability is triggered when the nativeImage.createFromPath() or nativeImage.createFromBuffer() functions process an image where an attacker controls the image dimensions (height and width) and contents. The overflow occurs in downstream image processing code called by these functions. Exploitation requires local access and low-level user privileges, and involves user interaction to open a malicious image file. An attacker can achieve memory corruption leading to code execution, information disclosure, or denial of service. Patches are available in Electron versions 28.3.2, 29.3.3, and 30.0.3.
Affected products
- Electron Electron all versions before 28.3.2; versions 29.0.0-alpha.1 to before 29.3.3; versions 30.0.0-alpha.1 to before 30.0.3
Timeline
- 2025-06-30: disclosed
- 2025-06-30: patched: Patches released in versions 28.3.2, 29.3.3, and 30.0.3