p PatchFirst

CVE-2026-54257

CVE-2026-54257 · Electron: Buffer performs incorrect byte length calculations resulting in heap buffer under/overflow

This page contains facts from public vulnerability sources. Check the original advisory before updating.

Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. From 42.3.1 until 42.3.3, Buffer performs incorrect byte length calculations resulting in heap buffer under/overflow. Most apps will crash and some may perform incorrect buffer allocations in the Node.js Buffer API resulting in unexpected truncation or allocation. This vulnerability is fixed in 42.3.3.

CVSS 9.3 · Critical · EPSS 0.4% · Fix available

Published
Updated

Stack: node

Affected products and versions

  • electron

    Versions
    • >= 42.3.1, < 42.3.3: Affected

    No fix published

  • electron npm

    Affected ranges
    • SEMVER: ≥ 42.3.1, < 42.3.3

    Update to 42.3.3

Original sources

Check your server →