PT-2026-49579 · Npm · Electron

Published 2026-06-15 · Updated 2026-06-16 · CVE-2026-54257

Positive Technologies (AI Summary)

CVSS v4.0

9.3

Critical

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Electron versions 42.3.1 through 42.3.2

Description Incorrect byte length calculations in the Node.js Buffer API cause heap underflow or overflow, which can lead to memory corruption or application crashes. This issue may result in incorrect buffer allocations, causing unexpected truncation or allocation. The flaw requires no privileges or user interaction to be triggered.

Recommendations Upgrade to version 42.3.3.

Fix

Buffer Overflow

Weakness Enumeration

CWE-120

Related Identifiers

CVE-2026-54257

GHSA-Q6M5-F73J-M9MC

Affected Products

Electron

References · 4

• https://osv.dev/vulnerability/GHSA-q6m5-f73j-m9mc · Vendor Advisory
• https://github.com/electron/electron · Note
• https://github.com/electron/electron/security/advisories/GHSA-q6m5-f73j-m9mc · Note
• https://twitter.com/UpwindMDR/status/2066787426693988475 · Twitter Post