GHSA-Q6M5-F73J-M9MC严重已审查

Electron: Buffer performs incorrect byte length calculations resulting in heap buffer under/overflow

OSV 1.4.0 · github-reviewed · 修改于 2026-07-21 05:02

发布时间

2026-06-16 04:20

GitHub 审查时间

2026-06-16 04:20

NVD 发布时间

2026-06-24 02:18

源文件

advisories/github-reviewed/2026/06/GHSA-q6m5-f73j-m9mc/GHSA-q6m5-f73j-m9mc.json

公告说明

Impact

Most apps will crash and some may perform incorrect buffer allocations in the Node.js Buffer API resulting in unexpected truncation or allocation.

Workarounds

No workarounds. Do not use these impacted Electron releases

Fixed Versions

42.3.3

For more information

If you have any questions or comments about this advisory, email us at [email protected]

受影响的软件包

npm

electron

ECOSYSTEM

引入42.3.1

标识信息

别名 / CVE

CVE-2026-54257

CWE

CWE-120

软件生态

npm

扩展资料

暂无扩展资料。

CVSS 评分

CVSS_V4

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

原始 OSV JSON

{
  "id": "GHSA-q6m5-f73j-m9mc",
  "aliases": [
    "CVE-2026-54257"
  ],
  "details": "### Impact\nMost apps will crash and some may perform incorrect buffer allocations in the Node.js `Buffer` API resulting in unexpected truncation or allocation.\n\n### Workarounds\nNo workarounds. Do not use these impacted Electron releases\n\n### Fixed Versions\n* `42.3.3`\n\n### For more information\nIf you have any questions or comments about this advisory, email us at [[email protected]](mailto:[email protected])",
  "summary": "Electron: Buffer performs incorrect byte length calculations resulting in heap buffer under/overflow",
  "affected": [
    {
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "42.3.1"
            },
            {
              "fixed": "42.3.3"
            }
          ]
        }
      ],
      "package": {
        "name": "electron",
        "ecosystem": "npm"
      }
    }
  ],
  "modified": "2026-07-20T21:02:00Z",
  "severity": [
    {
      "type": "CVSS_V4",
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"
    }
  ],
  "published": "2026-06-15T20:20:24Z",
  "references": [
    {
      "url": "https://github.com/electron/electron/security/advisories/GHSA-q6m5-f73j-m9mc",
      "type": "WEB"
    },
    {
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-54257",
      "type": "ADVISORY"
    },
    {
      "url": "https://github.com/electron/electron",
      "type": "PACKAGE"
    }
  ],
  "schema_version": "1.4.0",
  "database_specific": {
    "cwe_ids": [
      "CWE-120"
    ],
    "severity": "CRITICAL",
    "github_reviewed": true,
    "nvd_published_at": "2026-06-23T18:18:07Z",
    "github_reviewed_at": "2026-06-15T20:20:24Z"
  }
}