Electron Heap Buffer Overflow Vulnerability in NativeImage Functions

A heap buffer overflow vulnerability has been identified in Electron versions prior to 28.3.2, 29.0.0-alpha.1 through 29.3.3, and 30.0.0-alpha.1 through 30.0.3. The issue arises in the nativeImage.createFromPath() and nativeImage.createFromBuffer() functions, which call a downstream function susceptible to the overflow. An attacker can exploit this vulnerability if they control the image's dimensions and contents.

Impact

Exploitation of this vulnerability leads to a heap buffer overflow, allowing for potential memory corruption.

Remediation

Users should update Electron to version 28.3.2, 29.3.3, or 30.0.3.