CVE-2024-46993
Last modified
CVE-2024-46993 is a medium-severity vulnerability rated 4.4/10 on the CVSS scale. Electron is an open source framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. In versions prior to 28.3.2, 29.3.3, and 30.0.3, the nativeImage.createFromPath() and nativeImage.createFromBuffer() functions call a function downstream that is vulnerable to a heap buffer overflow. EPSS estimates a 0.13% chance of exploitation in the next 30 days.
Description
Electron is an open source framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. In versions prior to 28.3.2, 29.3.3, and 30.0.3, the nativeImage.createFromPath() and nativeImage.createFromBuffer() functions call a function downstream that is vulnerable to a heap buffer overflow. An Electron program that uses either of the affected functions is vulnerable to a buffer overflow if an attacker is in control of the image's height, width, and contents. This issue has been patched in versions 28.3.2, 29.3.3, and 30.0.3. There are no workarounds for this issue.
Metrics
CVSS:4.0/AV:L/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Weakness Enumeration
References
Timeline
- Published
- Last Modified
- Status
- Deferred
Frequently Asked Questions
What is CVE-2024-46993?
How severe is CVE-2024-46993?
How do I fix CVE-2024-46993?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2024
- CVE-2024-46987Camaleon CMS is a dynamic and advanced content management sy…7.7
- CVE-2024-46988Tuleap is a tool for end to end traceability of application …5.7
- CVE-2024-46989spicedb is an Open Source, Google Zanzibar-inspired permissi…5.3
- CVE-2024-4699** UNSUPPORTED WHEN ASSIGNED ** A vulnerability, which was c…9.8
- CVE-2024-46990Directus is a real-time API and App dashboard for managing S…5
- CVE-2024-46992Electron is an open source framework for writing cross-platf…7.8
- CVE-2024-46994baserCMS is a website development framework. Versions prior …5.4
- CVE-2024-46995baserCMS is a website development framework. Versions prior …6.1
- CVE-2024-46996baserCMS is a website development framework. Versions prior …5.4
- CVE-2024-46997DataEase is an open source data visualization analysis tool.…9.8
- CVE-2024-46998baserCMS is a website development framework. Versions prior …5.4
- CVE-2024-46999Zitadel is an open source identity management platform. ZITA…6.5
Are you affected by CVE-2024-46993?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST