CVE-2026-54257CWE-120

Electron: Buffer performs incorrect byte length calculations resulting in heap buffer under/overflow

Critical · published June 23, 2026

CVSS v4.0
9.3
EPSS
0%
Percentile
36.0
In the wild
Unconfirmed
What it is

Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. From 42.3.1 until 42.3.3, Buffer performs incorrect byte length calculations resulting in heap buffer under/overflow. Most apps will crash and some may perform incorrect buffer allocations in the Node.js Buffer API resulting in unexpected truncation or allocation. This vulnerability is fixed in 42.3.3.

The record
Technical detail
CVSS v4.0
9.3 · CRITICAL
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
EPSS
0.00428 · 36.0th percentile
Weakness
CWE-120 · Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')
Published
2026-06-23T17:08Z
EPSS history
Timeline
  • 23 JUN 17:08Z
    Electron: Buffer performs incorrect byte length calculations resulting in heap buffer under/overflow
    cvelistv5