---
id: CVE-2026-54257
aliases:
  - GHSA-q6m5-f73j-m9mc
title: >-
  Electron: Buffer performs incorrect byte length calculations resulting in heap
  buffer under/overflow
summary: >-
  Electron: Buffer performs incorrect byte length calculations resulting in heap
  buffer under/overflow
severity: critical
cwe:
  - CWE-120
vendor: electron
product: electron
ecosystem: npm
affected:
  - 'electron >= 42.3.1, < 42.3.3'
patched:
  - electron 42.3.3
published: '2026-06-15'
updated: '2026-06-15'
source: GHSA
sourceUrl: 'https://github.com/advisories/GHSA-q6m5-f73j-m9mc'
references:
  - url: >-
      https://github.com/electron/electron/security/advisories/GHSA-q6m5-f73j-m9mc
  - url: 'https://github.com/advisories/GHSA-q6m5-f73j-m9mc'
tags:
  - ghsa
  - npm
epss: 0.00428
epssPercentile: 0.34416
ingestedAt: '2026-07-07T15:41:58.654Z'
---

## Overview

### Impact
Most apps will crash and some may perform incorrect buffer allocations in the Node.js `Buffer` API resulting in unexpected truncation or allocation.

### Workarounds
No workarounds. Do not use these impacted Electron releases

### Fixed Versions
* `42.3.3`

### For more information
If you have any questions or comments about this advisory, email us at [security@electronjs.org](mailto:security@electronjs.org)

## Affected packages

- `electron >= 42.3.1, < 42.3.3`

## Remediation

Upgrade to a patched release:

- `electron 42.3.3`