CVE-2026-54257Critical▾ MidnightElectron: Buffer performs incorrect byte length calculations resulting in heap buffer under/overflow
▾ Midnight zone — Critical, or high with PoC / in-the-wild
impact 52.3 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Jul 7.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via GHSA
0.3%
0.3% → 0.4%
Most apps will crash and some may perform incorrect buffer allocations in the Node.js Buffer API resulting in unexpected truncation or allocation.
No workarounds. Do not use these impacted Electron releases
42.3.3If you have any questions or comments about this advisory, email us at [email protected]
electron >= 42.3.1, < 42.3.3Upgrade to a patched release:
electron 42.3.3Connected by shared product, vendor, weakness, or advisory.
CVE-2026-70612Medium· 5.4Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS
CVE-2026-70608High· 7.2Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS
CVE-2026-70609Medium· 5.7Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS
CVE-2026-70610Medium· 5.4Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS
CVE-2026-70611Medium· 6.9Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS
CVE-2026-70603Medium· 6.0Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS