Which versions of Electron are affected by CVE-2026-54257?

Electron runtime versions 42.3.1-42.3.2 contain a critical heap buffer overflow vulnerability exploitable remotely without authentication.. A patch is available.

How to fix or mitigate CVE-2026-54257?

24 hours: Identify and inventory all Electron-based applications running vulnerable versions 42.3.1-42.3.2. 7 days: Obtain and deploy vendor patch to all affected applications; prioritize business-critical systems. 30 days: Verify patch deployment across all endpoints and validate through automated compliance scanning.

Electron CVE-2026-54257

Q: What is the CVSS score of CVE-2026-54257?

CVE-2026-54257 has a CVSS 4.0 base score of 9.3 (Critical). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.3%.

EUVD-2026-38539 CRITICAL

Classic Buffer Overflow (CWE-120)

2026-06-15 https://github.com/electron/electron

GHSA-q6m5-f73j-m9mc

Node.js Buffer Overflow Red Hat

9.3

CVSS 4.0 · Vendor: https://github.com/electron/electron

Severity by source

Vendor (https://github.com/electron/electron) PRIMARY

9.3 CRITICAL

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

6.4 HIGH

Reaching the Buffer path typically requires the app to load attacker-controlled content (UI:R) and reliable memory corruption is non-trivial (AC:H); dominant impact is availability (crashes).

3.1 AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:H

4.0 AV:N/AC:H/AT:N/PR:N/UI:A/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N

Red Hat

7.1 HIGH

qualitative

Primary rating from Vendor (https://github.com/electron/electron).

CVSS VectorVendor: https://github.com/electron/electron

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Updated

Jun 23, 2026 - 18:28 vuln.today

v3 (cvss_changed)

Analysis Updated

Jun 23, 2026 - 18:28 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Jun 23, 2026 - 18:22 vuln.today

cvss_changed

CVSS changed

Jun 23, 2026 - 18:22 NVD

9.3 (CRITICAL)

Source Code Evidence Fetched

Jun 15, 2026 - 20:52 vuln.today

Analysis Generated

Jun 15, 2026 - 20:52 vuln.today

DescriptionCVE.org

Impact

Most apps will crash and some may perform incorrect buffer allocations in the Node.js Buffer API resulting in unexpected truncation or allocation.

Workarounds

No workarounds. Do not use these impacted Electron releases

Fixed Versions

42.3.3

For more information

If you have any questions or comments about this advisory, email us at [security@electronjs.org](mailto:security@electronjs.org)

Articles & Coverage 1

News Critical Heap Buffer Overflow in Electron 42.3.1/42.3.2 Node.js Buffer API - CVE-2026-54257 Jun 15, 2026

AnalysisAI

Heap buffer under/overflow in Electron's Node.js Buffer API (versions 42.3.1 through 42.3.2) causes most apps to crash and may lead to incorrect buffer allocations resulting in unexpected truncation or memory corruption. No public exploit identified at time of analysis, but the CVSS 4.0 base score of 9.3 reflects network-reachable, unauthenticated memory corruption with high impact to confidentiality, integrity, and availability. Affects any Electron-based desktop application shipping the vulnerable runtime.

Technical ContextAI

Electron is a cross-platform desktop application framework that embeds Chromium and a Node.js runtime, used by widely deployed apps like VS Code, Slack, Discord, and Microsoft Teams. The flaw lives in the Node.js Buffer API, where incorrect byte-length calculations classify under CWE-120 (Classic Buffer Overflow / improper input size validation). Because Buffer is a foundational primitive used to handle binary data, network payloads, IPC messages, and file contents, downstream code paths that feed attacker-controlled sizes into Buffer allocation or copy routines can either crash the renderer/main process or read/write past intended bounds, yielding heap under- or overflows.

RemediationAI

Vendor-released patch: Electron 42.3.3. Upgrade the Electron dependency to 42.3.3 or later (npm install electron@42.3.3) and rebuild and redistribute the application; end users receive the fix only when the bundling vendor ships a new app build, so application owners should expedite a release. The vendor explicitly states there are no workarounds and instructs users not to run the impacted releases. As compensating controls until rebuilt binaries are deployed, restrict the app from loading untrusted remote content (enforce contextIsolation, disable nodeIntegration in renderers, set a strict Content Security Policy, and validate or cap sizes on any data passed into Buffer.alloc/Buffer.from from network or IPC sources); these reduce reachability but do not patch the underlying miscalculation, and disabling features like remote content loading may break legitimate functionality. Track the GHSA advisory at https://github.com/electron/electron/security/advisories/GHSA-q6m5-f73j-m9mc for any follow-up guidance.