TI-2026-39157 Aliases CVE-2026-54257 GHSA-q6m5-f73j-m9mc

Electron: Buffer performs incorrect byte length calculations resulting in heap buffer under/overflow

MEDIUM 46CWE-120Published 2026-06-23 · Updated 2026-06-23

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: Low
Attack requirements: None
Impact type: Code execution
Confidentiality · integrity · availability: High · High · High
Fix status: Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA and GitHub. Impact type from CWE-120 and the CVSS impact.

Summary

Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. From 42.3.1 until 42.3.3, Buffer performs incorrect byte length calculations resulting in heap buffer under/overflow. Most apps will crash and some may perform incorrect buffer allocations in the Node.js Buffer API resulting in unexpected truncation or allocation. This vulnerability is fixed in 42.3.3.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00428 37th percentileScored 2026-11-07

Fix Fixed electron (electron): 42.3.3electron (npm): 42.3.3

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: Yes
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
electron	electron	42.3.1 to before 42.3.3	42.3.3	Patch available	CNA
—	electron (npm)	42.3.1 to before 42.3.3	42.3.3	Patch available	GHSA-q6m5-f73j-m9mc

electron Vendorelectron Affected 42.3.1 to before 42.3.3 Fixed in 42.3.3 Patch available CNA
electron (npm) Vendor— Affected 42.3.1 to before 42.3.3 Fixed in 42.3.3 Patch available GHSA-q6m5-f73j-m9mc

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPE	Versions	Role	Vendor
cpe:2.3:a:electronjs:electron::::::::	—	—	Electronjs

cpe:2.3:a:electronjs:electron:*:*:*:*:*:*:*:* Versions — — ·Electronjs

Remediation

Fix · CNA electron (electron) Fixed in 42.3.3
Fix · GHSA-q6m5-f73j-m9mc electron (npm) Fixed in 42.3.3 Advisory →

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

Not affected: 1 product

Red Hat Build of Podman Desktop

Timeline

2026-10-02 Threatist record created from CVE-2026-54257
2026-10-03 Alias added: GHSA-q6m5-f73j-m9mc

References

Advisory 1

https://nvd.nist.gov/vuln/detail/CVE-2026-54257

Other 2

TI-2026-39496 Information disclosure in electron-builder CVSS 4.0HIGH 8.2
TI-2024-26621 Code Signing Bypass on Windows in electron-updater < 6.3.0-alpha.6 CVSS 3.1HIGH 7.5
TI-2023-09452 Content-Secrity-Policy disabling eval not applied consistently in renderers with sandbox disabled in Electron CVSS 3.1CRITICAL 9.8
TI-2017-09308 GitHub Electron before 1.6.8 allows remote command execution because of a nodeIntegration… CVSS 3.0HIGH 8.1
TI-2022-11788 Exposure of Resource to Wrong Sphere in Electron CVSS 3.1CRITICAL 9.8
TI-2020-03557 Context isolation bypass via contextBridge in Electron CVSS 3.1CRITICAL 9.9

See all 74 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences